Two critical vulnerabilities were announced overnight in PHP, the programming language that underpins many websites on the internet, including sites running WordPress, Joomla, OpenCart and many other applications. As it is remotely exploitable, it affects any publicly accessible site or server where PHP is in use.
For information on the vulnerabilities, please search for CVE-2026-109618 and CVE-2026-109619
We'll be applying mitigations and updates across our servers when available, this page is to track progress for this,
Affected products are:
LiteSpeed Webhosting
Managed VPS (if running a PHP site)
Virtuozzo VPS [self managed] (if running a PHP site)
Update [14:30]
We have applied mitigations across our own sites, on LiteSpeed Webhosting (most customers) and on Managed VPS.
Note that such mitigations do not entirely eliminate the issue, however they do reduce the possible attack surface and are likely to provide a measure of protection against currently published exploits while we wait for updated PHP versions to become available for each platform.
Where we have access to customer managed VPS (Virtuozzo) we'll attempt also to apply mitigations when possible, however note that patching such servers is customer responsibility so we strongly recommend customers to assess their environments for exposure to this
Update [17:20]
Patches are expected shortly and will be rolled out as they become available this evening.
Update [21:55]
Our own customer facing sites are patched and other patches are being applied as they become available
Update [01:05]
All LiteSpeed hosting and Managed VPS servers are patched with updated versions. As we are using Tuxcare/ELS repositories, backported updates are available for all our available PHP versions including PHP7.4 that is still used by some hosting customers. Customers do not need to change PHP version via Plesk hosting control panel to gain coverage, however we do anyway recommend that you use PHP8.2 or higher where possible for your website.
Important: As these are backported security patches, the version number of PHP will NOT increase at this time, displayed version numbers will remain at the previous level. If you wish to check for yourself that you are running an updated version, please view the PHPInfo link in Plesk (can be found at Dashboard -> Dev Tools -> PHP) and check for a build date of 21 October 2026 or later.
Update [22/10 08:00]
We are continuing to check and monitor, however all ID customer facing sites, Managed VPS and LiteSpeed Hosting are updated and running well. Where possible, mitigations and patches will be applied to self-managed services (Virtuozzo VPS) where possible, however VPS customers are strongly recommended to assess their own sites and services to ensure protection. It appears a small number of VPS customers are running outdated operating systems or Panel versions, we'll reach out where possible in such cases so the customer can take any needed measures.
