Critical PHP vulnerability is already fixed

On 21 October PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. An unauthenticated HTTP request could run code on the server. Official fixes shipped only for PHP 8.2, 8.3, 8.4 and 8.5. PHP no longer maintains 8.1 and older, so on many hostings legacy sites stayed unpatched.

Not on MultiHOST. The fix is already in place. We run CloudLinux: the patch is applied both to current branches and to older ones that customer projects still need.

Legacy PHP versions protected by HardenedPHP

Why alt-php matters

If a site still runs PHP 5.6, 7.0–7.3 or 8.0–8.1, simply jumping to a new PHP version often breaks the code. For those branches we use alt-php — CloudLinux HardenedPHP. The site still sees the same PHP version, but with vendor security backports. For this issue the builds already include CVE-2026-109618 and CVE-2026-109619.

On MultiHOST shared hosting those versions are served through alt-php. Customers do not need to rewrite the site or change the PHP version in the panel because of this vulnerability.

What this means for you

MultiHOST hosting is already patched, including older PHP branches;
sites on PHP 5.6 and other EOL versions do not need an emergency move to 8.x only because of this bug;
if your current host has no patch for legacy PHP, moving to MultiHOST closes the hole without rewriting the project.

We watch incidents like this and fix them on our side, so customers can stay focused on the site instead of rebuilding PHP.

Need help migrating? Contact support. See the migration guide for details. Migration to MultiHOST is free.