PHP security response
We are actively working through the new PHP security advisories. We have begun applying supported permanent updates in controlled steps, while continuing to review other affected software and additional safeguards.
The first supported server-runtime update has been applied. Initial checks confirm the updated software is running and the checked service responds normally. Other software versions and services remain under review; the wider rollout and final verification are not complete.
24/7 automated monitoring: our scheduled checks follow official PHP announcements, PHP release feeds, the two advisories, and the relevant hosting vendor's release updates around the clock. The latest verified check of these sources completed at . We review new information as the response progresses; automated monitoring is not a promise that every possible source or attack is covered.
What a virtual patch means
A virtual patch is an extra filter designed to stop a known harmful request before it reaches a website. It can help reduce exposure while permanent updates are prepared. It is not a replacement for updating PHP, and one filter cannot be assumed to cover every way a vulnerability might be used.
Our response lifecycle
- COMPLETED INITIAL REVIEW
Understand the advisory
Confirm the official information and identify the software and services that need attention.
- INITIAL UPDATE VALIDATED
Validate safeguards and updates
The first supported update has passed initial compatibility checks. Other versions and temporary safeguards continue to be reviewed separately; one completed update is not proof of complete coverage.
- IN PROGRESS
Roll out carefully
The first permanent update is installed and initial runtime checks have passed. Further updates depend on supported packages and their own checks; rollout is not yet complete.
- CHECKS CONTINUING
Verify the result
Checks confirm the first updated runtime is in use and the checked service responds normally. Broader application checks and verification of remaining services are not complete. Temporary filtering is not labelled fully protective.
- CONTINUING THROUGHOUT
Keep watching and refine
Follow official advisories and relevant vendor release channels, review changes, and revisit temporary filters after permanent fixes are verified.
What customers should know
PHP has released security updates. Hosting vendors may distribute their own compatible packages on a different schedule. If your server is managed elsewhere, ask that provider to confirm the relevant PHP fixes are installed and in use. A CDN or WAF alone is not confirmation that a server has been patched.
We will update this page as verified milestones change. We keep public updates straightforward and do not publish internal defensive settings or exploit instructions.
Current coverage statement: controlled rollout is underway and initial checks of the first update have passed. Remaining versions and services still need their own updates and verification. This page does not claim that every service is patched, that every exploit is blocked, or that verification is complete.
Official references
This response tracks CVE-2026-109618 and CVE-2026-109619. See PHP's official security announcement, the first PHP advisory, the second PHP advisory, and CloudLinux's release and temporary-protection updates.