CRITICAL SECURITY NOTICE: PHP Vulnerabilities and Discontinuation of Unsupported PHP Versions

Published: 21 October 2026
Issued by: Enet Online Solutions Ltd.
Applies to: Shared Hosting, Reseller Hosting and VPS Customers

Dear Valued Clients,

Enet Online Solutions Ltd. wishes to notify all clients of two critical security vulnerabilities affecting PHP, the programming language used by many websites and web applications, including WordPress, Joomla, Drupal and various custom-built systems.

On 21 October 2026, the PHP development team released emergency security updates addressing these vulnerabilities. Both have a CVSS v4.0 severity score of 9.2 out of 10 and could allow attackers to execute malicious code on vulnerable servers without authentication. These vulnerabilities present a serious security risk to websites and hosting infrastructure running affected PHP versions.

1. Identified PHP Security Vulnerabilities

The official PHP security advisory identifies the following vulnerabilities:

CVE-2026-109618 — Remote Code Execution Through Out-of-Memory Corruption

This vulnerability involves improper handling of memory exhaustion during PHP request processing. Under certain conditions, PHP may attempt to process internal request data that has not been fully initialized, potentially allowing an attacker to execute arbitrary code.

CVE-2026-109619 — Remote Code Execution Through Stale Global State

This vulnerability involves internal request-related state remaining accessible after its associated memory has been released. A subsequent request handled by the same worker may use this stale state before it has been properly reinitialized, potentially allowing arbitrary code execution.

Potential consequences include:

• Unauthorized execution of malicious code on affected servers.

• Compromise of websites and web applications.

• Potential unauthorized access to website data and sensitive information.

• Increased risk to other websites hosted on shared hosting infrastructure if a server is compromised.

The PHP security team has identified PHP installations serving web requests as being at risk and strongly recommends immediate updates. The official advisory indicates that there are no complete workarounds that replace installing the security patches.

Official security advisory:
https://www.php.net/

2. Immediate Security Updates Required

The PHP project has released the following patched versions:

Clients and server administrators should update to the applicable patched release or a newer supported release that includes the security fixes. Customers using operating-system-provided PHP packages should check with their distribution or support provider for the corresponding security updates.

Official PHP version and security information:

https://www.php.net/supported-versions.php

3. Discontinuation of Unsupported PHP Versions

To protect our hosting infrastructure and customers, Enet will discontinue unsupported PHP versions on its shared hosting and reseller hosting platforms where the required security fixes are unavailable or cannot be applied safely.

This measure will take effect immediately as part of our security response. Unsupported PHP versions no longer receive regular security updates from the PHP project, leaving websites exposed to known and potentially future vulnerabilities.

Where a supported, patched PHP version is available, clients should upgrade as soon as possible rather than continue operating vulnerable installations.

Please note that the availability of an older PHP version in a hosting control panel does not necessarily mean that it remains secure or supported.

4. Action Required for VPS Customers

Clients operating VPS servers with PHP installations must also take immediate action.

Unless otherwise agreed under your service arrangement, VPS customers are responsible for maintaining and securing their server software, including PHP.

We strongly advise VPS administrators to:

• Identify all websites and applications running PHP.

• Update PHP to a patched release supported by their operating system or PHP distribution.

• Review PHP-FPM, Apache, LiteSpeed and other PHP execution configurations.

• Update outdated website applications, plugins, themes and custom scripts.

• Review server logs and security monitoring for suspicious activity.

Where immediate patching is not possible, administrators should consider isolating affected services from public access until they can be secured.

5. Upgrade Your Websites to a Supported PHP Version

We strongly recommend that all clients update their websites and applications to be compatible with PHP 8.2 or later, with a preference for a newer, currently supported branch wherever application compatibility permits.

Please note that PHP 8.2 is scheduled to reach the end of its security-support lifecycle on 31 December 2026. It should therefore be treated as a transitional minimum rather than a long-term upgrade target.

Before upgrading, take a full backup of your website files and databases, check application compatibility, and test critical functionality to reduce the risk of service interruptions.

6. Need Assistance?

If you need help determining which PHP version your website uses, updating your application, or resolving compatibility issues, please contact Enet through our client support portal.

We appreciate your cooperation and understanding as we take the necessary steps to protect our clients, their data and the reliability of our hosting services.

Thank you for choosing Enet Online Solutions Ltd.

Enet Online Solutions Ltd.
Your Trusted Hosting and IT Solutions Partner

Среда, Октомври 21, 2026

« Назад