PHP CVE-2026-109618 and CVE-2026-109619 Patched on All MioriticHost Web Hosting Servers

A quick recap of where things stood

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. That same day we published a detailed article explaining the vulnerabilities and immediately applied a server-side mitigation: disabling the session.upload_progress PHP option, as recommended in the official PHP security advisory. That mitigation stayed in place while we waited for fully patched packages from our platform vendors.

What we did overnight on October 21-22

• Active monitoring: we tracked the security release channels of cPanel and CloudLinux to know the moment patched PHP packages became available.
• Immediate manual installation: in the early hours of October 22, shortly after the packages were published, we installed them manually on all web hosting servers — without waiting for the next scheduled automatic update window.
• Every PHP version covered: the patch was applied across all versions running on our servers — from 8.5, 8.4, 8.3, and 8.2 down to 8.1, 8.0, 7.x, and 5.6. For older versions that the PHP project no longer maintains officially, the fix is delivered through CloudLinux's security backport mechanism.
• Web service restart: after installation we restarted the web services so PHP processes would load the new code. The restart was brief and was carried out at night when traffic is at its lowest.
• Mitigation remains active: the session.upload_progress restriction is kept enabled as an additional layer of defense, in line with the official advisory recommendation.

What you see in cPanel and what you need to do

You may notice that the PHP version number shown in cPanel under Select PHP Version or MultiPHP Manager has not changed — for example, if you were on 8.2.34, it still shows 8.2.34. This is expected behavior: the security fix is bundled inside the installed package without incrementing the visible version string. You do not need to change any settings or take any action for this patch. Your site is already running the corrected PHP code.

If you want a quick sanity check after the update, simply load your site and test its main features — contact forms, checkout flows, login pages. If anything looks off, open a support ticket and we will investigate. You do not need to be certain there is a problem before reaching out.

How server security works day to day at MioriticHost

Security for our customers’ sites is our top priority. We demonstrate that through actions: monitoring advisories, applying mitigations the same day a critical risk appears, and installing patches as soon as they are available.

Beyond the handling of this specific incident, MioriticHost servers run with several permanent protection layers: a ModSecurity web application firewall that filters malicious HTTP requests, a server-level firewall with automatic blocking of IPs attempting brute-force or scanning activity, periodic antimalware scanning of hosted files, and daily backups managed through JetBackup and accessible directly from cPanel.

In practice, the security incidents we see most often do not originate from server-level vulnerabilities — they come from outdated WordPress plugins or abandoned themes. The standing recommendations remain: keep WordPress core, themes, and plugins up to date; if your site runs on PHP 8.1 or older, plan a migration to 8.3 or 8.4 via MultiPHP Manager after taking a backup and checking plugin compatibility; and if you notice anything unusual on your site, open a support ticket rather than waiting to be sure something is wrong.