Technician in a server room

Security notice · 21/10/2026

Critical PHP vulnerabilities: measures applied on our servers (21/10/2026)

We applied protective measures the same day on all our shared and reseller hosting servers.

Today, 21 October 2026, two critical vulnerabilities in PHP, the language many websites run on, were published: CVE-2026-109618 and CVE-2026-109619. They are rated 9.2 out of 10 and could allow someone to run code on a server without logging in. They affect every version of PHP, at every provider in the world. The public advisory is on the CERT-EU website.

What we have already done

1 On the same day, we applied protective measures on all our shared and reseller hosting servers.
2 We switched off the PHP feature where the flaw was confirmed (the file upload progress bar) and set limits on uploads.
3 The permanent fix (the patched PHP) will be installed as soon as the vendor of our servers' operating system makes it available. The rollout has already started and we check every hour.

What changes for you

Shared and reseller hosting

You do not need to do anything. Your websites, e-mails and files stay as they were.

The only possible change: file uploads through forms are limited to 32 MB. If you need more, ask us through a support ticket.

VPS, Cloud and dedicated servers

You manage the server (root access): you must update PHP.

Until you update, follow the temporary measures from CERT-EU. If you prefer, open a support ticket and we will help. See how to update, step by step.

Best practices

• Keep WordPress, plugins and themes up to date.

• Use strong passwords, a different one for each service.

Any questions? Contact us through a support ticket in My MozOut or on WhatsApp, using the number in the footer of our website.

Open a support ticket



Wednesday, October 21, 2026





« Back