On October 21, 2026, two critical security vulnerabilities in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed. Under certain circumstances, these vulnerabilities could allow attackers to execute unauthorized code on web servers.

At NEOSERV, we responded immediately to the security advisory and promptly implemented all necessary protective measures in accordance with CloudLinux recommendations. We also successfully installed the official PHP security patches on our servers.

All necessary protections are now in place on our servers, and NEOSERV hosting customers do not need to take any additional action regarding these vulnerabilities.

How Did We Protect NEOSERV Servers?

Our web hosting services are based on the cPanel and CloudLinux platforms, which, among other features, enable centralized management of PHP versions and distribution of security updates. To protect against the two newly discovered vulnerabilities, we implemented several measures, described in more detail below.

1. Additional Protection with the Imunify360 Firewall

On October 21, the Imunify360 security solution received three new rules for its web application firewall (WAF). These rules are designed to identify and block known attack patterns that attempt to exploit the vulnerabilities.

In addition to the new rules, our servers also have additional protection based on IP address reputation, which helps identify and restrict traffic from potentially dangerous sources.

2. Installing Official CloudLinux Security Patches

During the night leading into October 22, CloudLinux released security-updated PHP packages, which we successfully installed on NEOSERV servers.

Importantly, the updates also cover older PHP versions, starting with PHP 5.6. Although these versions generally no longer receive security updates from the official PHP developers, CloudLinux provides its own security patches for them as part of its extended support.

This means that websites still using older PHP versions for compatibility with legacy applications are also protected.

Why Does PHP Still Show an Older Version Number?

If you check the PHP version in the terminal using php -v, you may notice that it shows a slightly older version number, such as PHP 8.4.26, even though PHP 8.4.27 is already officially available.

This does not mean that the security patches have not been installed.

CloudLinux uses a process called backporting, which incorporates security patches directly into existing, stable PHP packages without changing the base version number.

When checking installed patches, the PHP version number alone is therefore not decisive. What matters most is the exact release of the installed package and which security patches it includes. The package’s build date can also be helpful.

How to Check the PHP Build Date

You can check the PHP build date in the terminal using the following command:

php -i | grep -i 'Build Date'

Example output:

Build Date => Oct 21 2026 00:00:00

The appropriate CloudLinux security packages are already installed on NEOSERV servers, so these vulnerabilities have been addressed even where PHP still displays an older version number.

Do NEOSERV Hosting Customers Need to Take Action?

No. We have already implemented all necessary measures to address these PHP-level vulnerabilities across our server infrastructure.

Nevertheless, we continue to recommend regularly updating web applications such as WordPress, along with their themes and plugins, as this is an important part of comprehensive website security.

At NEOSERV, we will continue to monitor security advisories and install necessary updates promptly to keep your websites running in a secure and reliable environment.