Hello!

On 22 October 2026, we wrote to you about two critical security vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, and the protective measures we had put in place while patched versions were being prepared.

We confirm that this patching work is now complete across our shared hosting servers and the servers Allianz Cloud Hosting (ACH) manages for you.

What we have done
**
Shared hosting: cPanel and Plesk**
Every PHP version available on our shared hosting servers has been updated with the official security fixes released through the applicable CloudLinux, cPanel, Webuzo and Plesk update channels. PHP services were restarted so the fixes are active.

**A note for Windows hosting customers**
Going forward, our Windows hosting servers will carry only current, supported PHP versions. Patched builds of older PHP versions are available on our Linux hosting only.

If your website on Windows hosting needs an older PHP version, reply to this email. We will help you assess an upgrade to a supported PHP version or a move to Linux hosting, subject to your application’s requirements.
**
Managed Cloud VMs and dedicated servers**
All PHP versions on the servers we manage for you have been updated with the applicable security fixes, and the fixes are active.

**Additional protection stays in place**
We are retaining the additional server-level hardening applied during this incident, in line with PHP security-team guidance, along with our Imunify360 firewall rules where deployed, as a further layer of protection.

**Do you need to do anything?**

No action is needed to apply these fixes on ACH shared hosting or servers we manage for you. Your website files and settings have not been changed. A few things are still worth keeping in mind:

Running an older PHP version? On our Linux hosting, every PHP version offered from 5.2 onwards has received fixes for these vulnerabilities through our CloudLinux platform. This provides coverage for these specific issues, including on versions the PHP project no longer supports. It does not restore upstream support or guarantee protection against all vulnerabilities. We recommend planning a move to a supported release, such as PHP 8.3 or newer, after checking application compatibility. You can select your PHP version in cPanel through Select PHP Version or MultiPHP Manager, or in Plesk through PHP Settings, depending on your plan. Reply if you would like help before making a change.
Manage your own server? This completion notice does not cover unmanaged VMs or servers. Please make sure your administrator has installed the applicable patched PHP and control panel packages from official vendor repositories and restarted the affected PHP services.
Keep your website updated. Make sure your CMS, themes and plugins are on their latest compatible versions. PHP patches do not replace application updates.
Turn off session upload progress. Set session.upload_progress.enabled = Off in php.ini or your PHP-FPM pool configuration for every PHP version, then restart PHP-FPM (or Apache with mod_php).

Thank you for your patience while we worked through this. If you have any questions, simply reply to this email and our team will help.

Regards,

  • 星期日, 十月 25, 2026

« 返回