We’re pleased to share that PHP security patching has been completed across our shared Linux hosting environment to address the vulnerabilities CVE-2026-109618 and CVE-2026-109619.

As an additional precaution, the temporary security mitigation limits applied remain in place while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.

We’d also like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed.

This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included.

For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities.

Thank you for your patience and understanding as we continue to keep your hosting environment secure.