FullHost - Critical PHP vulnerabilities (CVE-2026-109618 / CVE-2026-109619) – Incident details

The PHP security release is now available and we have begun patching our systems. Fixed packages are being applied for all PHP versions down to PHP 7.4, so sites running older PHP versions on our platform will also receive the fix.

Patching is being rolled out in the following order:

1. Elastic Hosting

2. WordPress Hosting

3. Reseller Hosting

4. Managed Security VMs

5. Managed VMs

No action is required on your part. The interim mitigations (Imunify360 ruleset and session.upload_progress.enabled = Off) remain in place until patching is complete, after which the upload progress setting will be reverted.

Although this patch covers PHP 7.4 and newer on our platform, our recommendation remains unchanged: please move your sites to a current PHP version, preferably PHP 8.5, to ensure you continue to run a supported release and receive future security updates. cPanel customers can change this under Software → MultiPHP Manager.

We will post a further update once patching is complete across all platforms.

As a further temporary mitigation measure that came to light last night, we have set session.upload_progress.enabled = Off on all Elastic Hosting, WordPress Hosting, Reseller Hosting and Managed VPS servers. This disables PHP’s session upload progress tracking, which the publicly circulating exploit pattern relies on. This feature is rarely used by applications, so no impact is expected on your sites.

If you operate an unmanaged VM or a CoreGrid PaaS environment, we advise setting session.upload_progress.enabled = Off in your php.ini for the time being and restarting PHP-FPM or your web server for the change to take effect. This is a partial mitigation only and does not replace the upcoming PHP security update.

Imunify360, which protects all FullHost Elastic Hosting, WordPress Hosting and Reseller Hosting servers, as well as Managed VPS servers where the Imunify360 add-on has been purchased, has released a ModSecurity ruleset update (version 8.83, now in the Stable channel) as a temporary mitigation for CVE-2026-109618 / CVE-2026-109619.

The ruleset includes a blocking rule for the publicly circulating exploit pattern, which targets PHP’s session upload progress handling in multipart requests, along with a telemetry rule to track related activity. Servers running Imunify360 with its WAF (ModSecurity) enabled receive this ruleset automatically – no action is required on your part. Exploitation attempts matching this pattern are already being observed, and additional heuristic rules are being prepared.

Please note that this is an interim mitigation, not a complete fix. The official PHP security release remains scheduled for today, October 21, 2026 at 14:00 UTC (7:00 AM Pacific), and we will begin patching all systems as soon as it is available.

Our earlier recommendation stands: if any of your sites are running an unsupported PHP version (8.1 or older), switch them to PHP 8.2 or newer now.