We would like to inform you that we have completed the implementation of security patches for vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Scope of the update:

Web servers (shared hosting): all PHP versions from 5.2 to 8.5 have been patched.
VPS servers: PHP versions from 7.4 to 8.5 have been patched.
Internal systems: all versions in use have been patched.

The update was carried as soon as patches became available, with minimal service disruption; no action is required from our clients.

For VPS clients using PHP versions older than 7.4, we recommend migrating to a supported version, as patches are not available for those releases.

Should you have any questions, please contact our Customer Support team

Note for shared hosting clients: the PHP version number shown in your account (e.g. 8.5.11) will not change after the update. This is expected. The security fixes were applied directly to the PHP versions you already use, without upgrading them to a newer release. To confirm that your site runs on the patched version, check the build date instead of the version number. A build date of [DD Month 2026] or later means the patch is active. You can check it in one of two ways:

On your website: open the PHP information page (phpinfo) and find the “Build Date” line.
Via SSH: run php85 -v.
The build date is shown in brackets after the version number, e.g. (built: Oct 21 2026 ...).