![[SUMMARY]On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabi...](https://img3.estateagents1.com/759/841/1612110477598415.jpg)
22/10/2026
[SUMMARY]
On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code ex*****on.
You can find out more information about the CVEs on the URLs below:
https://www.cve.org/CVERecord?id=CVE-2026-109618
https://www.cve.org/CVERecord?id=CVE-2026-109619
The PHP Team has released the patched versions last night: https://www.php.net/index.php #2026-10-21-5
[Affected Products]
These vulnerabilities could affect all PHP versions from PHP 5 onwards.
[Our Actions Taken Since Yesterday]
Throughout the day and night yesterday, we have been following-up with our different vendors to ensure risks were being mitigated while the PHP patches got released.
As soon as they were released, we ensured they got applied as soon as possible to our entire infrastructure.
Everything was patch since last night itself, and all mitigations were implemented on our firewalls during the day as well.
[KINSTA]
If you are on our KINSTA plan, the security team has applied mitigation with regards to disabling the below variable as well as implementing Cloudflare rules:
- session.upload_progress.enabled
As soon as the PHP updates were available and verified, they were automatically applied to your sites.
You will find out more information about the actions taken at https://status.kinsta.com/incidents/c0c6xl1ghpb2
[CPANEL]
If you're on one of our cpanel servers, we protect you using imunify360 firewall and cloudlinux hardened PHP.
The Imunify360 ModSecurity ruleset 8.83 has been applied to your account during the day yesterday to mitigate the risks. It contained a blocking rule for the publicly circulating exploit shape for CVE-2026-109618 / CVE-2026-109619, which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity.
You may follow progress on that at https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
[GWS Cloud]
GWS Cloud runs on WP Cloud via our partnership with Automattic (The founders of wordpress), and they have also applied custom WAF rules in the meantime the official patch was released yesterday.
They also had mitigations in place directly on their infrastructure early yesterday as they closely worked with the security team of the PHP foundation to ensure their infrastructure was fully secured.
[We take your security seriously]
Throughout the day and night yesterday, we followed-up closely with our different platform and security vendors on your behalf to ensure your servers were properly secured in the meantime the patches were released, and ensured the patches were applied to your sites as soon as they were released and validated.
If you are not hosting your sites with us, we highly encourage you to reach out to your hosting company or web agency to ensure they’ve applied the security patches for you already.
Should you want to explore our managed fully secure hosting solutions, you will find our plans at https://gws.cloud/
If you have any questions, please feel free to reach out to us on https://gws.cloud/ via the live chat.
