Critical: PHP Security Mitigation

Update timeline

1. monitoring Oct 21, 2026, 04:59 PM UTC

   PHP Security Mitigation We have applied a mitigation across all servers by setting session.upload_progress.enabled = Off in PHP. This change has been implemented in response to a recently disclosed PHP vulnerability. Patching of affected PHP versions will begin as soon as the vendor releases the relevant updates, which are currently expected later today. Impact on your website: If your website relies on PHP session upload progress functionality, you may need to update your code in the short term to remove or bypass this functionality until the relevant PHP patches are available and applied. We will continue to monitor the situation and provide further updates as patching progresses. Thank you for your understanding.

2. monitoring Oct 21, 2026, 09:39 PM UTC

   We have applied several ModSecurity rules on all servers earlier today. We are continuously monitoring the situation and will apply the patch as they become available.

3. monitoring Oct 21, 2026, 10:43 PM UTC

   We ultimately used a different approach to block the vulnerability related to 'session.upload_progress.enabled'. One of the ModSecurity rules we added blocks calls to this variable. If you see that 'session.upload_progress.enabled' is still On, no need to worry since ModSecurity will block any call to this. We apologize for the confusion this as caused.

4. resolved Oct 22, 2026, 12:29 PM UTC

   All PHP versions have been updated with the fix for CVE-2026-109618 and CVE-2026-109619 during the night.