No impact incident

Crucial Hosting: CloudLinux PHP Security Update – Version Number Clarification for CVE-2026-109618 and CVE-2026-109619

Affected: Virtual Server Platform

Current status of Crucial Hosting: Operational — live Crucial Hosting status

Timeline

1. Oct 23, 2026, 07:28 UTC
   monitoring
   Dear Customer, We’d like to clarify that some customers may still see PHP version numbers such as 8.2.34, even after the security patching has been completed. This is expected for servers running CloudLinux. CloudLinux has applied the required security fixes to its existing PHP packages without necessarily changing the version number. As a result, your PHP version may appear older than the fixed versions listed in the official PHP announcements, but the security fix for CVE-2026-109618 and CVE-2026-109619 is already included. For example, CloudLinux’s PHP 8.2.34 package includes the required security fix, so upgrading specifically to PHP 8.2.35 is not necessary to address these vulnerabilities. Our teams continue to monitor the environment. Thank you for your patience and understanding as we continue to keep your hosting environment secure.

Updates as published by Crucial Hosting (original).