By Month
By Month
PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
- Wednesday, 21st October, 2026
- 19:48pm
You may be aware that two critical vulnerabilities were disclosed in PHP today affecting all versions from 5.x through 8.x. These vulnerabilities allow for arbitrary remote code execution and are deemed critical.
All NitroHost servers are now running patched versions of PHP, including backported fixes for PHP 5.x and 7.x.
Additionally WAF (Web Application Firewall) rules are in place that detect and block attempts to exploit these (now patched) vulnerabilities. Offending IPs will be blocked at the firewall level automatically, so please do not try to test any of the publicly available exploits against your site. Your server access will be immediately blocked.
We are continuing to monitor the situation and will provide updates as needed.
