No impact incident

Crucial Hosting: Security Advisory: PHP Vulnerabilities – Recommended Action for Self-Managed Servers

Affected: Virtual Server Platform

Current status of Crucial Hosting: Operational — live Crucial Hosting status

Timeline

1. Oct 22, 2026, 04:59 UTC
   monitoring
   Dear Customers, We would like to bring to your attention two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may affect PHP installations on your servers. If you are using a self-managed VPS or Dedicated Server, we recommend reviewing your installed PHP version and applying the relevant security updates as advised by your PHP distribution or operating system provider. What you need to do: Review the PHP versions installed on your server to determine whether they are affected. If your installation is affected, apply the appropriate security updates following your operating system, control panel's recommendations. If your websites are running on older PHP versions (anything below php 8.1), we recommend updating your websites to be compatible with the latest supported PHP versions and upgrading the PHP version on your server accordingly. If you are unsure how to proceed, consult your system administrator or contact our support team for guidance. Please note: For self-managed VPS and Dedicated Servers, maintaining server software and applying security updates are the customer's responsibility. We recommend addressing this advisory promptly to help protect your server and hosted websites from potential security risks. Thank you for your attention and cooperation. Our support team is available to assist with any questions you may have.

Updates as published by Crucial Hosting (original).