[Action Required] Critical PHP Security Update

Tweet

Security Announcement: Critical PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

[ Follow up / update posted on 2026/10/24 ] 

Title: PHP Security Upgrade Complete — PHP Version Migration Plan

Dear Customers and Partners,

We have completed the PHP security patch upgrade on all servers. To ensure the long-term security of your website, please check the PHP version currently used by your website and plan an upgrade according to the following recommendations.

PHP Version Status and Action Requirements

Important Note on PHP 7.4–8.1

You may see that PHP 7.4–8.1 have recently received security patches—this is because cPanel, to prevent a global large-scale exploitation wave, exceptionally backported the fix for this vulnerability to these already end-of-life versions. This is not a signal that these versions have returned to supported status. cPanel will not continue to monitor or patch future vulnerabilities for these versions. Continuing to run PHP 7.4–8.1 means your website will no longer receive routine security protection.

If you have any questions, please login to clients area to create support ticket.

Nocser Support Team
ModernOne Data Solutions Sdn. Bhd.
Nocser.net

[ First Posted on 2026/10/22]

Priority: Critical — Action Required Immediately

Dear Valued Customers and Resellers,

The PHP project has released emergency security updates to address two critical vulnerabilities in PHP that allow unauthenticated remote code execution (RCE) . These vulnerabilities affect servers running PHP, including those using cPanel and DirectAdmin, and impact applications such as WordPress and other PHP-based software.

The PHP project rates both vulnerabilities as Critical (CVSS 9.2). There are no complete mitigations other than updating PHP

Affected Versions

What You Need to Do

If you are on a shared hosting plan with Nocser.net:

• We will perform the server backend update.
• Customers are required to check and update their websites to be compatible with at least PHP 8.2.35. 
• Resellers are required to check and update their clients' websites to be compatible with patched version
• We will enforce the PHP version update on your all website. Vulnerable php version will be remove from server

If you manage your own Cloud or dedicated server through us:

• We will perform the server backend update.
• Customers and Resellers are required to check and update their websites to be compatible with at least PHP 8.2.35. We will enforce the PHP version update on your website upon your request

If you are on an unmanaged server:

• You are required to take responsibility for upgrading your own server and websites.

Additional Notes

• Updating WordPress, plugins, or themes will not resolve this issue. These vulnerabilities reside in PHP itself.
• Web application firewalls (WAFs) may reduce risk but are not a substitute for patching.
• After patching, we recommend reviewing your site for any signs of compromise (unfamiliar admin accounts, modified PHP files, or web shells).
• PHP 5.x and 7.x are end-of-life and will not receive official security fixes. Websites still running these versions must migrate to a supported PHP version as soon as possible.

Questions?

If you are unsure which PHP version your account is using, please check via your control panel or contact our support team. We are prioritizing this update across all managed servers.

Thank you for your prompt attention to this critical security matter.

Nocser.net Security Team