Critical PHP security vulnerabilities in October 2026: This is how CURIAWEB protects your website
October 21, 2026 | Security & Web Hosting
On October 21, 2026, two critical security vulnerabilities were discovered in the PHP programming language that affect numerous websites and web applications worldwide. Under certain conditions, these vulnerabilities allow for serious attacks on web servers.
Popular systems such as WordPress, WooCommerce, and WHMCS are also based on PHP and can therefore be affected.
At CURIAWEB, we take such security notifications seriously. Our hosting servers already feature additional protection mechanisms, including Imunify360 with a current Web Application Firewall (WAF). At the same time, we are preparing the installation of the final PHP security updates.
What happened?
The PHP security team has published two critical vulnerabilities that are identified by the following identifiers:
- CVE-2026-109618: A vulnerability in the memory management during the processing of specially prepared HTTP requests.
- CVE-2026-109619: A mistake in the management of internal data that allows previously released storage areas to be reused under certain circumstances.
Both vulnerabilities were rated with a CVSS severity level of 9.2 out of 10 points evaluated and are therefore considered critical.
Under certain conditions, attackers can exploit these security vulnerabilities to execute malicious code on an affected system without prior authorization.
The vulnerabilities are located directly in PHP and not in WordPress, WooCommerce, or other applications.
Which PHP versions are affected?
The security vulnerabilities affect numerous PHP versions, including older versions that are still used on many web servers.
The PHP project has published the following corrected versions on October 21, 2026:
| PHP version | Security update |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
For older PHP versions that are no longer supported by the official PHP project, specialized providers such as CloudLinux can provide additional security fixes.
Therefore, what is crucial is not only the displayed PHP version number, but also whether the respective provider has integrated the required security fixes.
How does CURIAWEB protect its hosting customers?
Our hosting infrastructure relies on several coordinated security mechanisms. These include CloudLinux, Imunify360, and a web application firewall.
Immunify360 with up-to-date security policies
Immunify360 monitors and protects our hosting environment from various attack patterns.
Particularly important in connection with the current PHP security vulnerabilities is the integrated Web Application Firewall (WAF).
CloudLinux has already released additional protection rules with the Imunify360 rule set 8.83, which are intended to block the publicly known attack pattern against these vulnerabilities.
The newer version of the regulations 8.84 is already installed on our CURIAWEB server.
These protection rules can detect and block any corresponding attempts to attack before they reach the affected PHP application.
This is an additional security measure that reduces the risk. However, it does not replace the final PHP security updates.
CloudLinux as an additional layer of security
Our hosting servers use CloudLinux, a server environment specifically designed for web hosting.
CloudLinux enables, among other things, the isolation of individual hosting accounts and the controlled allocation of server resources.
This allows for limiting the effects of certain errors or attacks to other hosting accounts.
These protection mechanisms are also not a complete substitute for security updates, but they complement our multi-stage security concept.
Ongoing security monitoring
In addition to the automated protection mechanisms, we monitor the security situation and track the publications of the relevant software manufacturers.
For critical security reports, we examine which components of our hosting infrastructure could be affected and what measures are required.
When will the final security updates be installed?
The corrected PHP versions were published by the PHP project on October 21, 2026.
The providers cPanel and CloudLinux are working on providing these corrections in their respective PHP packages.
CURIAWEB will install the appropriate security updates as soon as the corrected packages are available for our server environment.
Until then, we rely on the existing security mechanisms and the current protection rules of Imunify360.
We are continuously monitoring the development and will update this post as soon as the security updates have been installed on our servers.
Do CURIAWEB customers need to take any action?
If your website is hosted on CURIAWEB, you do not have to do anything yourself to install the server-side PHP security updates. We will handle this for you.
Regardless of this, we recommend regularly updating WordPress, plugins, themes, and other applications used.
Because even though the current security vulnerabilities directly affect PHP, a well-maintained and up-to-date website remains an important component of overall security.
Security is a priority at CURIAWEB
No hosting provider can guarantee absolute security. What matters is how quickly new threats are detected and what protective measures are already in place.
With CloudLinux, Imunify360, current firewall rules, and ongoing security monitoring, CURIAWEB has several layers of protection.
Our goal is to identify risks early, fend off known attack patterns, and deploy necessary security updates as quickly as possible.
We take care of the security of our hosting infrastructure so that you can focus on your website and business.
