The past couple of months have been unusually busy on the security front. Serious vulnerabilities were disclosed in PHP, LiteSpeed Web Server and the Linux kernel, several with public exploits. Every one of them has been patched across all of our servers, and nothing further is required on your end. Below is a high-level rundown of what was fixed and what we did about it.
Critical PHP Vulnerabilities (php2shell)
All PHP versions we offer are fully patched against CVE-2026-109618 and CVE-2026-109619, the pair of PHP engine flaws nicknamed php2shell. Both are rated 9.2 (CVSS v4.0) and can let an attacker run code on a server without logging in. They have since been exploited in the wild, which made speed critical.
| Date | What we did |
|---|---|
| October 20 | Began monitoring as soon as the flaws were announced, and put interim mitigations in place through php.ini and Imunify360. |
| October 21 | Updated every server the moment CloudLinux published patched alt-php packages. CloudLinux backported the fixes into the existing versions, so version numbers did not change at first. |
| October 22 | Installed CloudLinux’s re-released alt-php packages, versioned to match PHP’s official fixes (8.2.35, 8.3.36, 8.4.27, 8.5.12). The code is identical to the earlier patched builds; only the reported version number changed. |
PHP 5.6 through 8.1 are no longer maintained by PHP directly, but they remain secured with CloudLinux’s backported patch. That said, if your site still runs one of these older versions, now is a great time to move to PHP 8.2 or newer. Continue reading