Announcements
- Thursday, 22nd October, 2026
- 05:40am
We are sharing an important update regarding a global security event and the action our team has taken to keep your websites safe.
What happened
On October 21, 2026, two critical vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 Critical. This was a global security event affecting PHP installations worldwide. The flaws could allow attackers to run malicious code on unpatched servers, putting websites everywhere at risk.
What we did
As soon as the vulnerability was disclosed, our team moved quickly:
- Within the first hour — Imunify360 WAF protection was already blocking known exploit attempts across our network.
- Within hours — we applied emergency hardening across our entire infrastructure as a precaution.
- Same day — every server was patched the moment the official fixes were released, and all PHP services were restarted to apply them.
While this was a worldwide critical incident, your websites and data stayed protected from the very first hour.
We also shared a public update on our Facebook page as we responded: View the update
Do you need to do anything?
No. Your account is already fully protected. No action is required from your side.
One quick note on version numbers
You may notice your PHP version still shows as 8.2.34 or 8.4.26 in cPanel. This is normal and safe. On CloudLinux, security fixes are added inside the existing version, so the number stays the same on purpose. It does not change to 8.2.35 or 8.4.27, but the full fix is already included.
Reference: CloudLinux Security Advisory
Stay updated with us
For real-time updates during global security events, maintenance, and service announcements, follow us. During incidents like this, it is the fastest way to stay informed.
- Follow us on Facebook: facebook.com/hostgrap
- Follow the HostGrap channel on WhatsApp: Join here
Thank you for trusting HostGrap with your hosting. Your security is always our priority.
— The HostGrap Team
