Critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Identified - On October 21st, the PHP project released an emergency security update to fix two critical vulnerabilities in PHP, known as CVE-2026-109618 and CVE-2026-109619. Details of these vulnerabilities were leaked publicly before the fix was available.

What is the issue?

The vulnerabilities allow an attacker to run their own code on a server by sending a specially crafted request to any website that runs PHP. No login or special access is needed, and the attack happens before the website’s own code runs. This means that every PHP website is affected, regardless of which software it uses (WordPress, Laravel, custom code, …).

Is InfinityFree affected?

Yes. Like practically every PHP hosting provider, our hosting was affected by these vulnerabilities.

What has been done so far?

Our hosting uses PHP packages provided by CloudLinux. At the time the vulnerabilities were announced, CloudLinux did not have fixed PHP packages available yet.

To protect our hosting and all websites on it in the meantime, iFastNet has temporarily blocked multipart/form-data POST requests, which are used by the attack. Unfortunately, these requests are also used by many regular website forms, notably forms with file uploads. This is causing the 403 errors described in this incident.

CloudLinux has since released updated PHP packages that fix the vulnerabilities. iFastNet is preparing to roll these out to all hosting servers. Once that’s done, the temporary block will be lifted.

What do I need to do?

You don’t need to do anything for your InfinityFree hosting account. PHP is managed by us, and will be updated on all servers automatically.

Why does my website still show an older PHP version?

The PHP project fixed these vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, CloudLinux has not upgraded to these versions. Instead, they have taken the security fixes and applied them to the PHP versions they already provide (this is called “backporting”).

This means that after the update, the PHP version shown for your website (for example in phpinfo() or WordPress Site Health) will most likely still be a lower version number, likely still 8.4.25 instead of 8.4.27. This is expected: the version number doesn’t change, but the vulnerabilities are fixed. Security scanners and plugins that only look at the version number may still report your website as vulnerable, even though it isn’t.

We will post an update here once the fixed PHP version is rolled out on all servers.