No impact incident

InterServer: Upcoming PHP Security update

Affected: Webhosting, Storage

Current status of InterServer: Operational — live InterServer status

Timeline

1. Oct 20, 2026, 21:27 UTC
   investigating
   An upcoming PHP security update is planned to be released tomorrow - https://www.php.net/archive/2026.php#2026-10-20-1 No further information is available at this time.
2. Oct 20, 2026, 22:47 UTC
   investigating
   The official PHP project will likely not provide security patches for versions older than PHP 8.2. Servers running cPanel or DirectAdmin with CloudLinux utilize HardenedPHP and will receive these patches over time. Standard DirectAdmin servers without CloudLinux do not currently support HardenedPHP, though we are actively consulting with the CloudLinux team to determine if standalone Imunify360 servers can utilize it. Additionally, if the exploit is within PHP-FPM, servers running LiteSpeed are likely unaffected. Depending on the severity of the issue, sites on non-CloudLinux systems without HardenedPHP may be required to update to PHP 8.2 or higher, or migrate to a CloudLinux system (which will require an IP address change).
3. Oct 21, 2026, 11:34 UTC
   investigating
   On shared hosting systems with in the last few hours session.upload_progress.enabled = Off Has been set off with in php.ini as all as in litespeed under the main config file using php_value. This closes a possible part of of the exploit, but officially this mitigation does not come directly from PHP devs.
4. Oct 21, 2026, 12:27 UTC
   investigating
   Imunify360 has release ModSecurity ruleset 8.83 which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity. All webhosting servers have been verified to be running this version. Storage directadmin does not offer imunify360. These run modsecurity with owasp ruleset.
5. Oct 21, 2026, 14:18 UTC
   investigating
   Directadmin custombuild is available: This moves PHP 8.5, 8.4, 8.3, 8.2 to latest version, and adds patches for PHP 8.1, PHP 8.0 and PHP 7.4 Please be aware PHP lower than 7.4 will be removed, if installed through custombuild at this time. PHP selector from cloudlinux will patch via alt-php.
6. Oct 21, 2026, 15:41 UTC
   investigating
   Cpanel has released 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33 and these are now being applied.
7. Oct 21, 2026, 23:32 UTC
   investigating
   All cpanel systems ea-php* packages have been updated. However some include back ports such as ea-php84 is 8.4.26, not 8.4.27.
8. Oct 22, 2026, 00:10 UTC
   investigating
   directadmin storage systems (with out cloudlinux) have been patched
9. Oct 22, 2026, 00:14 UTC
   investigating
   directadmin legacy and cloudlinux are patched and going through final checks.
10. Oct 22, 2026, 11:54 UTC
    investigating
    Update: Security Patches Deployed for PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) We have deployed security updates across our cPanel, DirectAdmin, and Webuzo hosting environments to address the recent PHP vulnerabilities. Shared Hosting Proactive Mitigations Before the official PHP updates were even released, we proactively forced session.upload_progress.enabled=0 across all shared hosting servers as a partial mitigation. We also deployed custom Web Application Firewall (WAF) rules to inspect and protect multi-part uploads against this exploit. These servers are now receiving the full PHP patches as outlined below. cPanel Servers For cPanel systems, the fixes are applied as backports. This means your PHP version number will not change to the latest upstream release (for example, ea-php84 remains at 8.4.26 instead of showing 8.4.27). To confirm the fix is active on a cPanel server, you need to check the package changelog for the CVE IDs rather than looking at the PHP version number. You can verify this via SSH using the following command (replace ea-php84 with your installed version):rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)' DirectAdmin Servers On DirectAdmin, modern PHP branches have been updated to the fully patched upstream releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For older, legacy PHP versions (5.6 through 8.1), the security fixes have been successfully applied as custom patches through CustomBuild. Webuzo Servers For Webuzo environments, all PHP packages spanning versions 5.6 through 8.5 are available for updates by logging into webuzo Manual Workaround for Unmanaged Servers If you are running an unmanaged server and cannot apply the PHP updates immediately, you can temporarily mitigate the vulnerability by disabling session upload progress. To do this, add or update the following line in your active php.ini file:session.upload_progress.enabled=0 while updates applied.
11. Oct 24, 2026, 12:13 UTC
    investigating
    ea-php (cPanel EasyApache 4) builds with the PHP.net version numbers are now in the stable repositories: - ea-php82: 8.2.35-1, for CloudLinux OS 7, 8, 9, 10 and CloudLinux OS for Ubuntu 22.04 - ea-php83: 8.3.36-1, for CloudLinux OS 7, 8, 9, 10 and CloudLinux OS for Ubuntu 22.04 - ea-php84: 8.4.27-1, for CloudLinux OS 8, 9, 10 and CloudLinux OS for Ubuntu 22.04 - ea-php85: 8.5.12-1, for CloudLinux OS 8, 9, 10 and CloudLinux OS for Ubuntu 22.04 Previous versions were backported. The new releases show the updated versions.

Updates as published by InterServer (original).