Critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Thu, 22 Oct 2026 09:00:00 +0000

Identified - On October 21st, the PHP project released an emergency security update to fix two critical vulnerabilities in PHP, known as CVE-2026-109618 and CVE-2026-109619. Details of these vulnerabilities were leaked publicly before the fix was available.

What is the issue?

The vulnerabilities allow an attacker to run their own code on a server by sending a specially crafted request to any website that runs PHP. No login or special access is needed, and the attack happens before the website’s own code runs. This means that every PHP website is affected, regardless of which software it uses (WordPress, Laravel, custom code, …).

Is InfinityFree affected?

Yes. Like practically every PHP hosting provider, our hosting was affected by these vulnerabilities.

What has been done so far?

Our hosting uses PHP packages provided by CloudLinux. At the time the vulnerabilities were announced, CloudLinux did not have fixed PHP packages available yet.

To protect our hosting and all websites on it in the meantime, iFastNet has temporarily blocked multipart/form-data POST requests, which are used by the attack. Unfortunately, these requests are also used by many regular website forms, notably forms with file uploads. This is causing the 403 errors described in this incident.

CloudLinux has since released updated PHP packages that fix the vulnerabilities. iFastNet is preparing to roll these out to all hosting servers. Once that’s done, the temporary block will be lifted.

What do I need to do?

You don’t need to do anything for your InfinityFree hosting account. PHP is managed by us, and will be updated on all servers automatically.

Why does my website still show an older PHP version?

The PHP project fixed these vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, CloudLinux has not upgraded to these versions. Instead, they have taken the security fixes and applied them to the PHP versions they already provide (this is called “backporting”).

This means that after the update, the PHP version shown for your website (for example in phpinfo() or WordPress Site Health) will most likely still be a lower version number, likely still 8.4.25 instead of 8.4.27. This is expected: the version number doesn’t change, but the vulnerabilities are fixed. Security scanners and plugins that only look at the version number may still report your website as vulnerable, even though it isn’t.

We will post an update here once the fixed PHP version is rolled out on all servers.

(22 Oct - 09:00 UTC)

Websites are returning 403 errors from OpenResty on POST requests

Wed, 21 Oct 2026 17:46:00 +0000

Identified - iFastNet is currently preparing the PHP updates. Once they are ready, they will be rolled out to all servers, and the temporary block on multipart/form-data POST requests will be lifted. They expect to be able to complete this within two hours. (22 Oct - 08:57 UTC)

Identified - CloudLinux has released updated PHP packages over the night to address the vulnerabilities. We are trying to get confirmation from iFastNet about when these updates will be rolled out. (22 Oct - 08:47 UTC)

Identified - We have received confirmation from iFastNet about this issue.

Earlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited.

Our hosting runs PHP packages provided by CloudLinux. CloudLinux has not yet distributed the fixed PHP version. We are waiting for them to provide the PHP version that contains the security fixes.

Until then, to keep our hosting and all websites on it safe, iFastNet was forced to block certain requests from reaching PHP, which includes blocking all multipart/form-data POST requests.

This block will remain in effect until the new PHP packages are published and rolled out on all hosting servers.

(21 Oct - 19:14 UTC)

Investigating - We have investigated the issue and have a better idea of the impact.

The problem occurs when making a POST request to websites using the multipart/form-data content type. POST requests using form-urlencoded data are not affected. Other data types are unclear at this time.
- Explained simply: some forms on websites will return this error, other won’t. Notably forms that involve file uploads.
All accounts seem to be affected by this, regardless of website IP or domain name used.
This issue potentially affects all website software, including WordPress and Laravel. How much functionality is impacted by this issue depends on the website software used.

(21 Oct - 18:22 UTC)

Investigating - We are currently investigating reports of 403 errors on websites on free hosting. (21 Oct - 17:46 UTC)

Websites on InfinityFree Status

Critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Websites are returning 403 errors from OpenResty on POST requests