Two critical PHP remote code execution flaws (CVSS 9.2) patched October 21; hosting providers racing to update infrastructure
My Take
What happened PHP released emergency patches on October 21 for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2), but exploit code was already circulating before the fix dropped, and days later some shared hosting providers had still not patched their infrastructure.
Why it matters to hosts If your servers run PHP—which most shared, reseller, and managed WordPress hosts do—you became a target the moment public exploits emerged, and staying unpatched leaves every customer site on your platform vulnerable to remote compromise. Patch lag directly translates to customer risk and liability.
What to do Verify right now which of your PHP-running servers have been updated to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (depending on your branch), and if any are still on older versions, prioritize them for immediate updates this week.
My view This is a patch-management execution problem, not a PHP problem. The PHP team did its job—they coordinated disclosure and released fixes. The real issue is that some hosting providers allowed servers to remain unpatched for days after patches were available, and exploit code was being weaponized in the wild before even the coordinated disclosure window closed. If you're a smaller host with manual patch processes, this is a wake-up call to automate or outsource security updates. If you're larger and still dragging on patches, you're gambling with your customers' sites.
After seeing exploits in the wild before coordinated disclosure even concluded, how many of you have actually automated PHP patching across your infrastructure, and how many are still doing it manually?
Key Themes
Notable Players
Released emergency security fixes on October 21, 2026 for two critical remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) across versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Published mitigation guidance and kernel updates for multiple Linux kernel vulnerabilities including Infinity Core, CVE-2026-99999, BTR, and KEV-listed CVEs; announced CloudLinux ELevate now supports in-place upgrades from CloudLinux 8 to 9 with Plesk.
Had private keys for eight CA certificates leaked, compromising the ability to forge TLS certificates and impersonate any domain protected by those certificates.
Security breach allowed hackers to install backdoors on WordPress sites, affecting over 3 million active installations.
Researchers using GPT-5.6 Sol uncovered the two critical PHP vulnerabilities and coordinated fixes; Chainguard subsequently faced criticism from the PHP project over disclosure timing and early exploit availability.
Top Stories
PHP announced emergency fixes for two CVSS 9.2 remote code execution vulnerabilities, but details leaked before patches shipped. Every PHP-running hosting provider needs immediate updates to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
Days after PHP patches dropped, some shared hosting providers—including one major player—had not yet applied the fix to production servers. If your host hasn't confirmed patch status, ask directly by name.
Private keys from Indian certification authority eMudhra were leaked, compromising TLS certificate integrity and enabling domain impersonation attacks. Older devices and software installations may not recognize revocation, requiring immediate action by certificate issuers.
Six Linux kernel vulnerabilities disclosed under the Infinity Core banner include five with working root-level exploits for unprivileged local users. Hosting operators on CloudLinux need to review which bugs affect their kernel version and apply updates accordingly.
Major hosting providers including Hostinger are repositioning their offerings beyond raw server capacity, bundling hosting with business tools and services. This shift reflects competition from cloud platforms and changing customer expectations for integrated solutions.
Security & Compliance
A Linux kernel networking stack flaw allows unprivileged local users to rewrite files they can only read. CloudLinux has published mitigation guidance for affected server administrators.
A third vulnerability in the PHP2Shell family has been discovered but will not receive an emergency patch, suggesting researchers are still uncovering related flaws in PHP's core code.
Active exploitation of PHP2Shell demonstrates attackers are investing effort in weaponizing the vulnerability and defeating built-in PHP protections. Researchers note adversaries are clearly spending resources on this flaw.
Researchers using OpenAI's GPT-5.6 Sol uncovered two critical PHP vulnerabilities (CVSS 9.2) and built working exploits in two weeks from a bug that had evaded human developers for two years. AI-assisted research is accelerating vulnerability discovery.
Community alert warning that all PHP versions are vulnerable to a major remote code execution exploit affecting any system running PHP. Hosting operators needed to patch immediately on October 21.
Cloudflare observed millions of exploit attempts, while AWS confirmed attackers were trying the vulnerability four days before patches became available. Active exploitation is ongoing across hosting infrastructure.
A Canadian hosting provider acknowledged the critical PHP vulnerability and provided guidance, but the title highlights that some hosting operations had not yet deployed patches while the industry raced to update.
A critical Linux kernel flaw (CVSS 9.3) in IPv4 checksum handling on virtio-net allows untrusted VM guests to escape to the host system. CloudLinux servers and shared hosting on virtual infrastructure require immediate kernel patching.
Six Linux kernel vulnerabilities with five public root exploits affect CloudLinux 8, 9, and 10. Hosting providers running these platforms need kernel updates; status varies by version.
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalogue in September 2026. CloudLinux has published kernel updates addressing these flaws across supported versions.
CloudLinux confirmed PHP package updates for the two critical October 21 vulnerabilities and noted Imunify360 protection status. Hosting providers on CloudLinux should verify package versions across their fleet.
A Spectre v2 variant (BTR) allows unprivileged local users to read kernel memory without achieving root. Every CloudLinux version except 7 is affected and requires kernel patching.
Hackers installed backdoors on WordPress sites using UpdraftPlus, putting 3 million active installations at risk. Managed WordPress hosting providers should audit customer sites running this plugin for signs of compromise.
The PHP project criticized Chainguard's handling of coordinated vulnerability disclosure, accusing the security vendor of allowing exploit code to circulate before patches were available. The disagreement highlights tensions over responsible disclosure timing.
DigitalOcean confirmed awareness of the two critical PHP remote code execution vulnerabilities and urged immediate patching. Cloud hosting providers published guidance for customers running PHP on their infrastructure.
Emergency PHP security fixes became available October 21, affecting websites globally including WordPress installations. Site owners were urged to request immediate patches from their hosting providers.
As PHP fixes shipped on October 21, security advisors recommended taking sites offline if they could not be patched immediately. Active exploitation with published exploits made this an unusually urgent scenario.
GoDaddy published guidance on the October 21 PHP emergency release, explaining the vulnerability scope and urging customers to request patches from their hosting account team immediately.
Low-end hosting community mobilized around the October 21 PHP emergency release, highlighting the urgency and scope of the vulnerability for small hosting operations.
Leaked private keys from eMudhra certification authority enable attackers to forge TLS certificates and impersonate any protected domain. Certificate issuers and browser vendors face a massive cleanup job to revoke affected certificates.
Control Panels
A reseller hosting offering combining Plesk control panel with Windows/.NET infrastructure and SQL Server databases. Represents integration of hosting control panel with managed database and application runtime support. --- #HostSecure
Technology & Tools
CloudLinux ELevate now supports in-place upgrades from CloudLinux 8 to 9 for servers running Plesk, eliminating the need for reinstalls or account migration. Hosting providers using Plesk can now upgrade infrastructure without customer downtime.