The PHP project has rated the following vulnerabilities as Critical. These vulnerabilities affect PHP itself, and may impact PHP installations across all major hosting environments, including cPanel, DirectAdmin, and Plesk.
We have already updated all shared hosting platforms and managed servers to use the patched PHP versions.
Affected vulnerabilities
- CVE-2026-109618
- CVE-2026-109619
What you should do
- Identify affected PHP installations: Review the PHP versions used by your websites and applications.
- Apply security updates: Ensure your server's PHP packages are updated to patched releases when available. On cPanel, DirectAdmin, and Plesk servers, check that the relevant PHP versions and packages are covered.
- Contact your us if needed: If you do not manage server-level updates yourself, confirm that your provider is addressing the vulnerabilities.
- Plan any required maintenance: If updates require a service restart or maintenance window, plan accordingly to minimize disruption.
Important for Provider.lk customers: If you use shared hosting, PHP updates are managed at the server level. If you operate a VPS or dedicated server, responsibility depends on your management and support plan. Please contact our support team if you need clarification about your hosting environment.
For technical details and patched-version guidance, refer to the official PHP security advisories linked above.
