Security Advisory: PHP Vulnerability Updates and CloudLinux HardenedPHP Protection CVE-2026-109618 and CVE-2026-109619 | Hosting & Semi-dedicated hosting clients

Published: October 24, 2026
Category: Security Advisories
Status: Security fixes verified on audited infrastructure
Affected Software: PHP 7.4, PHP 8.4 and potentially other PHP branches

IndiHosts Responds to Recently Disclosed PHP Vulnerabilities

At IndiHosts, maintaining the security, stability, and reliability of our hosting infrastructure is a continuous priority.

Following the disclosure of two PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, our technical team initiated a review of the relevant PHP packages, vendor security updates, and hosting security controls.

Our investigation has confirmed that updated PHP packages containing vendor-documented fixes for both vulnerabilities are installed on the infrastructure audited.

Security Updates Verified

The following security-maintained PHP packages were verified during our investigation:

PHP Version	Package Release	Security Status
PHP 8.4	8.4.27-1.el8.cloudlinux	Fixes for both CVEs documented
CloudLinux PHP 7.4	7.4.33-81.el8	Security backports for both CVEs documented

The installed package changelogs explicitly reference CVE-2026-109618 and CVE-2026-109619.

This confirms that the respective software vendors have incorporated fixes addressing these vulnerabilities into the installed package releases.

Our technical team continues to review applicable security updates across our hosting infrastructure.

Extended Security Protection for Legacy PHP Applications

Many websites and business applications continue to depend on older PHP versions because of compatibility requirements.

While PHP 7.4 has reached its official upstream end-of-life, IndiHosts uses CloudLinux HardenedPHP to provide extended security maintenance for supported legacy PHP environments.

CloudLinux HardenedPHP incorporates selected security fixes into older PHP branches through a process known as security backporting.

This means a PHP version may retain its original version number while receiving additional security fixes through updated CloudLinux packages.

For example, CloudLinux PHP 7.4.33-81 includes security maintenance beyond the final upstream PHP 7.4.33 release.

This provides an additional layer of protection for customers who cannot immediately migrate their applications to newer PHP versions.

Nevertheless, we continue to recommend upgrading applications to currently supported PHP versions wherever compatibility permits.

Multiple Layers of Hosting Security

Our CloudLinux and LiteSpeed hosting environments incorporate several technologies designed to improve security, resource management, and operational reliability.

CloudLinux CageFS

CageFS provides filesystem isolation between hosting accounts, helping restrict unauthorized access to other customers’ files and sensitive system resources.

CloudLinux LVE

Lightweight Virtual Environment (LVE) technology helps control resource consumption by individual hosting accounts, reducing the impact of resource-intensive applications on other customers.

LiteSpeed Web Server

LiteSpeed provides an optimized web-serving environment with support for PHP execution through LSAPI.

Security-Maintained PHP Packages

Applicable PHP security updates are distributed through the relevant CloudLinux and cPanel software repositories.

Together, these technologies contribute to our layered infrastructure security strategy.

Security Monitoring and Automated Threat Activity

Internet-facing websites are routinely targeted by automated vulnerability scanners attempting to discover exposed configuration files, outdated software, and other weaknesses.

During our recent investigation of an audited hosting environment, we observed automated attempts to access sensitive configuration paths.

The examined requests were denied with HTTP 403 responses, and the reviewed access logs did not identify successful exploitation of the reported PHP vulnerabilities.

These observations are limited to the specific environment and records examined and should not be interpreted as a comprehensive security assessment of every hosted website.

Do Customers Need to Take Action?

Customers do not need to change their PHP configuration solely because of this advisory where the applicable security-patched packages are already installed.

However, we recommend that all website owners follow established security practices:

Keep WordPress, Joomla, Drupal, and other applications updated.
Regularly update plugins, themes, frameworks, and third-party libraries.
Use supported PHP versions whenever application compatibility allows.
Enable multi-factor authentication where available.
Maintain independent backups of important website files and databases.
Remove unused applications, development files, and obsolete software.

Customers running legacy PHP applications may contact our support team for assistance in reviewing their available PHP upgrade options.

Our Ongoing Security Commitment

IndiHosts continuously evaluates infrastructure security advisories and applicable vendor updates.

Our objective is to deliver reliable hosting services while balancing security, application compatibility, and service continuity.

We will continue reviewing relevant PHP security updates and applying appropriate measures across our managed hosting environments.

Customers requiring clarification about their PHP version or hosting configuration are welcome to contact IndiHosts Technical Support.

IndiHosts Security & Infrastructure Team

Secure Hosting. Reliable Infrastructure. Continuous Improvement.