Skip to main content 
On October 22, 2026, at 3:57 AM, we completed deploying all available PHP security patches provided by CloudLinux. The updates covered all our web servers and the PHP lines we support, from 5.3 to 8.5. We began work immediately after the official patches became available.
Critical PHP Security Vulnerabilities. What Happened?
On October 21, 2026, DNSC Romania published a warning about two critical vulnerabilities in PHP, marked with identifiers CVE-2026-109618 and CVE-2026-109619 .
The vulnerabilities could allow a remote attacker to execute code on a vulnerable server without requiring prior authentication. This poses a significant threat to the infrastructure supporting websites and applications using PHP. The vulnerabilities affect the PHP runtime itself, so they are not limited to a single CMS or application.
PHP is used by popular content management systems such as WordPress and Joomla, as well as many other web applications.
The seriousness of the situation was confirmed by announcements from the PHP development team. The recommended way to address the vulnerability is to install appropriate security patches.
More information can be found in the official PHP security announcement .
How did mybox respond to the CVE-2026-109618 and CVE-2026-109619 vulnerabilities?
From the beginning, we monitored announcements regarding new vulnerabilities and prepared the infrastructure to implement the targeted security measures as quickly as possible.
Even before official patches were released by software vendors, we implemented available mitigations. One of these was disabling the PHP parameter session.upload_progress.enabledby setting its value to Off.
After the PHP developers published the patches and CloudLinux made the appropriate packages available, our administrators began implementing them on subsequent systems.
The first systems received the targeted security patches on October 21, 2026, at 4:05 PM , just minutes after the planned release date of the PHP security update.
Work continued throughout the night. On October 22, 2026, at 3:57 AM, all available patches were deployed.
All mybox web servers are secured
As of October 22, 2026, all of our web servers have the current PHP security patches provided by CloudLinux for CVE-2026-109618 and CVE-2026-109619. This deployment covers our supported PHP lines ranging from 5.3 to 8.5 , subject to the availability of the relevant vendor packages and patches.
This is important because the hosting infrastructure can support multiple applications and different PHP versions simultaneously. Rapidly deploying patches across the entire environment helps mitigate the risk of vulnerabilities within the PHP interpreter itself.
To our knowledge, mybox was one of the first, and probably the first, hosting provider in Romania to complete the implementation of all available patches for the PHP versions it supports in such a short time.
What does this mean for mybox customers?
The fixes were implemented on our infrastructure side, so customers using the affected environments do not have to install these server updates themselves.
Regardless of what administrators do, it’s important to remember to regularly update your own websites. This applies especially to CMS systems like WordPress, as well as the themes, plugins, and other application components you use.
It’s also important to use a sufficiently up-to-date version of PHP. Language updates not only improve security but can also provide better compatibility and application performance. For older PHP lines, the extent of available patches depends on the support provided by the respective vendor.
Hosting infrastructure security is an ongoing process
The CVE-2026-109618 and CVE-2026-109619 vulnerabilities demonstrated the importance of quickly responding to critical threats in core software used by websites.
At mybox.com, we launched shortly after midnight on October 21st, implemented interim security measures, and then began updating subsequent systems as targeted patches became available. We completed the full rollout of all available PHP security updates on October 22nd, 2026, at 3:57 AM .
We would like to thank our clients for their support throughout the entire process.
