Web Hosting PHP Security Updates October 2026
Overview
On 21 October 2026, two significant security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were identified in PHP, a widely used programming language that powers many websites, including WordPress and other content management systems (CMS).
Webvault has applied the necessary security updates to its cPanel and CloudLinux hosting platforms to address both vulnerabilities including backport fixes for older PHP versions.
An additional PHP security advisory, CVE-2026-115560, was published on 23 October 2026. This issue affects an uncommon combination of website settings and is discussed below.
To download this Advisory in PDF Format Click Here
What has Webvault done?
Webvault's PHP hosting infrastructure uses cPanel and CloudLinux, which provide security updates and additional protection for websites hosted on our platform.
Following the release of the PHP security updates:
Automatic security updates: The relevant security patches were automatically deployed to our hosting systems shortly after their release by cPanel and CloudLinux.
Additional website protection: Our hosting platforms also use the Imunify Web Application Firewall (WAF), which provides an additional layer of protection against malicious website traffic. Security protection rules supplied by CloudLinux were already in place.
Ongoing maintenance: Webvault continues to maintain and update its hosting infrastructure as new security fixes become available.
These measures address the two critical PHP vulnerabilities announced on 21 October 2026.
Customers do not need to take any special action to install these hosting platform security updates.
An additional PHP security advisory – CVE-2026-115560
On 23 October 2026, the PHP development team published an additional security advisory, CVE-2026-115560, concerning certain specialised PHP website configurations.
Unlike the earlier vulnerabilities, this issue only arises under an uncommon combination of website settings and programming practices.
Most websites are unlikely to use the particular configuration involved. The advisory does not mean that websites with file upload forms or similar features are automatically vulnerable.
Where websites use customised PHP applications or specialised configurations, some additional website-level checks or adjustments may be necessary.
Webvault is monitoring the associated security updates and will continue applying applicable fixes as they become available.
Customers operating older or highly customised websites may wish to ask their website developer to review their website's configuration as part of routine security maintenance.
Developers and technical users can refer to our Technical Guide for remediation of CVE-2026-115560:
PHP Security Advisory CVE-2026-115560 Technical Guide
Important: Keep your website's PHP version up to date
Although the recent critical PHP security issues have been addressed on Webvault's hosting platforms, customers should also ensure their websites are not relying on outdated or unsupported PHP versions.
PHP is continually developed, with older versions eventually reaching their end of support.
While CloudLinux provides additional security maintenance for certain older PHP versions, this should not be considered a permanent alternative to upgrading your website.
We recommend that customers ensure their websites are running a currently supported PHP version wherever possible.
Keeping WordPress and other website software secure
PHP is only one component of your website. Websites using WordPress, Joomla, Drupal, Magento, Moodle or other content management systems should also be regularly maintained.
We recommend ensuring that:
Website software is up to date: WordPress and other CMS platforms should be updated regularly.
Plugins and extensions are maintained: Install available security updates and remove plugins that are no longer required.
Themes are kept updated: Outdated website themes can also introduce security risks.
Unsupported software is replaced: Older plugins, themes and applications that no longer receive security updates should be reviewed.
Periodic security reviews are performed: Your website should be periodically checked for outdated components and potential security issues.
Keeping these components updated helps protect your website against security vulnerabilities that cannot necessarily be addressed through hosting platform updates alone.
What do I need to do?
For most customers, no immediate action is required in relation to the recent critical PHP security updates.
However, we recommend arranging a routine website maintenance review if your website has not been checked or updated recently.
As part of this review, we recommend checking that:
Your website uses a supported PHP version.
Your website's CMS, plugins, extensions and themes are up to date.
Any outdated or unsupported website components have been reviewed.
Any specialised PHP configurations are reviewed where relevant to the additional October security advisory.
These are sensible ongoing maintenance practices, regardless of the recent PHP security announcements.
Contact your website designer or developer
If your website is professionally maintained, we recommend contacting your existing website designer or developer in the first instance.
Your developer understands how your website was built and is best placed to assess its software, plugins, custom functionality and any compatibility requirements.
They can review the recommendations in this article and determine whether any website updates or changes are necessary.
Additional Webvault Security Services
If you don't have a website developer or would like Webvault to assist your developer with pre and post website security remediation efforts please contact Webvault Support or call 1300 139 927. An outline of available services are as follows:
Pre-remediation security assessments: Review the website's security status and help identify potential vulnerabilities before maintenance or remediation work begins.Hosting and PHP configuration assistance: Help developers with PHP upgrades, hosting configuration and related compatibility issues.
Security remediation assistance: Work alongside your developer to investigate and resolve identified vulnerabilities, including hosting-related issues and common website security problems.
Post-remediation security assessments: Perform follow-up checks after updates or remediation work to help verify that identified issues have been addressed.
Technical assistance: Work with your developer to investigate security alerts, troubleshoot hosting issues and address other security concerns.
For customers and website developers seeking additional technical information, the relevant security advisories are:
| Security advisory | Description | Status |
|---|---|---|
| CVE-2026-109618 | Critical PHP security vulnerability announced on 21 October 2026. | Hosting platform security updates applied. |
| CVE-2026-109619 | Critical PHP security vulnerability announced on 21 October 2026. | Hosting platform security updates applied. |
| CVE-2026-115560 | Additional PHP security advisory announced on 23 October 2026, affecting uncommon website configurations. | Further vendor updates being monitored. Website-level review may be appropriate for specialised applications. Web developers refer to PHP Security Advisory CVE-2026-115560 Technical Guide |
Official reference: PHP Security Announcements – October 2026