Dhosting PL incident
CVE-2026-109618 & CVE-2026-109619 Security measure implemented for all our clients
Resolved on October 22, 2026, affecting Hosting (WWW).
We would like to inform you that we have completed the implementation of security patches for vulnerabilities CVE-2026-109618 and CVE-2026-109619. Scope of the update: Web servers (shared hosting): all PHP versions from 5.2 to 8.5 have been patched. VPS servers: PHP versions from 7.4 to 8.5 have been patched. Internal systems: all versions in use have been patched. The update was carried as soon as patches became available, with minimal service disruption; no action is required from our clients. For VPS clients using PHP versions older than 7.4, we recommend migrating to a supported version, as patches are not available for those releases. Should you have any questions, please contact our Customer Support team Note for shared hosting clients: the PHP version number shown in your account (e.g. 8.5.11) will not change after the update. This is expected. The security fixes were applied directly to the PHP versions you already use, without upgrading them to a newer release. To confirm that your site runs on the patched version, check the build date instead of the version number. A build date of [DD Month 2026] or later means the patch is active. You can check it in one of two ways: On your website: open the PHP information page (phpinfo) and find the “Build Date” line. Via SSH: run php85 -v. The build date is shown in brackets after the version number, e.g. (built: Oct 21 2026 ...).
Affected components
Update timeline
- resolved Oct 22, 2026, 02:00 AM UTC
We would like to inform you that we have completed the implementation of security patches for vulnerabilities CVE-2026-109618 and CVE-2026-109619. Scope of the update: Web servers (shared hosting): all PHP versions from 5.2 to 8.5 have been patched. VPS servers: PHP versions from 7.4 to 8.5 have been patched. Internal systems: all versions in use have been patched. The update was carried as soon as patches became available, with minimal service disruption; no action is required from our clients. For VPS clients using PHP versions older than 7.4, we recommend migrating to a supported version, as patches are not available for those releases. Should you have any questions, please contact our Customer Support team Note for shared hosting clients: the PHP version number shown in your account (e.g. 8.5.11) will not change after the update. This is expected. The security fixes were applied directly to the PHP versions you already use, without upgrading them to a newer release. To confirm that your site runs on the patched version, check the build date instead of the version number. A build date of [DD Month 2026] or later means the patch is active. You can check it in one of two ways: On your website: open the PHP information page (phpinfo) and find the “Build Date” line. Via SSH: run php85 -v. The build date is shown in brackets after the version number, e.g. (built: Oct 21 2026 ...).
Your product runs on more than Dhosting PL
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services