Critical PHP Security Vulnerabilities: How Fastnet Has Responded to Protect Customers


At Fastnet, keeping our customers’ services secure and reliable is a top priority. Two critical security vulnerabilities affecting PHP were disclosed this week, and our technical team has been applying the essential security updates across our managed hosting infrastructure.
We can confirm that security patching has been completed across all Fastnet shared hosting servers and managed customer virtual machines (VMs). This includes patched builds for legacy PHP versions from 5.2 right through to 8.5.


What has happened?
On 20 October 2026, the PHP security team gave advance notice of an upcoming critical security release. The following day, 21 October, the PHP development team released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
On the same day, the UK’s National Cyber Security Centre (NCSC) issued an alert encouraging UK organisations to take immediate action.
PHP is a widely used programming language that powers millions of websites and web applications, including popular platforms such as WordPress.
Both vulnerabilities are memory-handling flaws in PHP itself. They are not in any particular website, plugin or CMS. They could allow an attacker with no login or account to run malicious code on an affected web server. The attack can happen before the website’s own code has even started to run. Both have been rated critical, with severity scores of 9.2 out of 10.
According to the PHP project, every PHP installation that serves web requests is at risk. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the risk considered highest for Apache mod_php. The PHP project is clear that there are no complete workarounds and that updating is the only safe option.

What action has Fastnet taken?
Our engineering team acted as soon as the fixes were released. Our work has included:

  • Shared hosting infrastructure: applying the relevant security patches across all Fastnet shared hosting servers.
  • Managed customer VMs: completing security patching across our managed customer virtual machines.
  • Legacy PHP versions: installing CloudLinux’s patched alt-php builds, which cover every alt-php version from PHP 5.2 through to 8.5. Websites on older PHP versions are protected against these vulnerabilities as well.
  • cPanel PHP packages: installing cPanel’s updated EasyApache 4 PHP packages for PHP 8.2 to 8.5, together with cPanel’s backported fixes for PHP 7.4, 8.0 and 8.1.
  • PHP version upgrades: moving affected environments to a patched, supported PHP release where appropriate.
  • Removing outdated PHP versions: removing older PHP installations in selected environments, to reduce reliance on unsupported software.
  • Additional hardening: disabling PHP’s session upload progress feature, which blocks one of the known attack routes for these vulnerabilities.
  • Web application firewall: Imunify360 firewall rules that block known exploit attempts were in place on our CloudLinux servers several hours before the PHP fixes were released. They continue to be updated as new attack patterns emerge.

This work forms part of our ongoing commitment to maintaining secure, reliable hosting environments for our customers.

What about older PHP versions?
Every PHP version below 8.2 has reached the end of its official support lifecycle. That means these versions no longer receive routine security fixes from the PHP development team.
Because these vulnerabilities are so severe, the PHP security team made an exception. It published minimal backported fixes for PHP 7.4, 8.0 and 8.1, and shared the patches with Linux distributions and long-term support vendors in advance.
Some hosting software vendors routinely protect older versions through a process called security backporting. Backporting takes a fix written for a newer PHP release and adapts it to work on an older version. The site gets the fix without a full upgrade.
For this incident, CloudLinux has released patched builds for every PHP version it maintains, from PHP 5.2 all the way to 8.5. cPanel has released backported fixes for PHP 7.4, 8.0 and 8.1. Between the two, websites on legacy PHP versions across our CloudLinux and cPanel platforms are covered.
Backported fixes do not always change the PHP version number shown by the server. The installed package can contain the security corrections while still reporting an older version.

Why your PHP version number may look out of date
You may notice that your website still reports an older PHP version number, such as 7.4 or 8.1, rather than the newest releases listed above. Some website security scanners, plugins and audit reports may also flag this as a risk. That does not mean the security fix is missing. Fastnet servers use PHP builds maintained by CloudLinux, which apply the security patches for CVE-2026-109618 and CVE-2026-109619 directly to each PHP version, a process known as backporting. The patched package therefore contains the required fix, but it keeps its original version number so that your website continues to work exactly as before. Automated tools often judge security by the version number alone, so they can report a false positive even when the server is fully protected. If a scan or report raises a concern, contact our support team. We can confirm that your hosting environment is running the patched build and provide the details your auditor or IT provider needs.

Backporting also does not mean older PHP versions are officially supported again, or that every possible security issue in them is fixed. We may not be able to rely on backported fixes for future vulnerabilities. Upgrading to a newer, officially supported PHP version remains the recommended long-term approach, and the NCSC gives the same advice.
At Fastnet, we aim to balance security with application compatibility. That way we can keep customer environments protected while keeping unnecessary disruption to a minimum.

Why are PHP updates important?
Like all software, PHP needs regular security updates to address newly discovered vulnerabilities. Keeping PHP up to date helps to:

  • reduce exposure to known security vulnerabilities
  • protect websites, applications and customer data
  • maintain compatibility with supported software and security technologies
  • improve the long-term reliability of hosting environments.

Please note that PHP 8.2 reaches end of life on 31 December 2026, so it will stop receiving security fixes after that date. If your website runs on PHP 8.2 or older, now is a good time to plan a move to PHP 8.3 or newer.

Do customers need to take any action?
Customers using Fastnet shared hosting or managed VM services do not need to take action for this vulnerability – We have patched the servers for you.
Because the flaw is in PHP itself, updating website plugins or themes does not protect against it. Keeping your applications up to date is still good practice, and so is checking that your website works on a current PHP version.
If you run a self-managed server or hosting environment, we recommend following the NCSC’s priority actions:

  • Find every system running PHP, starting with anything exposed to the internet. All versions may be affected, so don’t limit the search to older ones.
  • Apply the latest security updates from your operating system or hosting software vendor, including any backported fixes for older versions.
  • Restart Apache, PHP-FPM or LiteSpeed afterwards, because the fix does not take effect until every PHP process has been restarted.
  • Check other products that include PHP, such as appliances, control panels and third-party software, and apply their vendors’ updates as they become available.
  • Check for signs of compromise if a system could not be patched promptly. That includes any backdoors an attacker may have left behind.

If you are unsure whether your environment is up to date, our support team will be happy to provide guidance.

Proactive security, managed by Fastnet
This incident shows how important it is to keep hosting environments secure and regularly updated. Our engineers continuously review security advisories from PHP, our software vendors and the NCSC. We assess the potential risks and take appropriate action to protect the infrastructure entrusted to us.


For businesses, having an experienced technical team manage this means they can stay focused on their day-to-day operations.

Further reading

Need advice about your hosting security?
Contact our team at help@fastnet.co.uk or visit fastnet.co.uk to find out more about our managed hosting services.