Security Maintenance: PHP Configuration Updates

Update timeline

1. identified Oct 21, 2026, 03:27 AM UTC

   We are applying urgent security mitigations across our server infrastructure to address recently disclosed PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619). As part of this update, we are disabling the default PHP session.upload_progress.enabled setting. While standard platforms (including WordPress) remain unaffected, custom non-WordPress sites relying on PHP native file upload progress tracking may experience functionality changes.

2. identified Oct 21, 2026, 02:40 PM UTC

   Our Systems Engineering and Security teams are actively deploying critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: **Dedicated Servers:** Resolved. Updates have been successfully applied across all dedicated server infrastructure. **VPS Containers:** In Progress. Security patches are currently being deployed across all virtual private servers. **Shared Hosting:** Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. You can follow upstream progress directly via the [CloudLinux Incident Status Page](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5).

3. identified Oct 21, 2026, 08:16 PM UTC

   Our Systems Engineering and Security teams are continuing to deploy critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: Dedicated Servers: In Progress. Updates have been successfully applied across all dedicated server infrastructure. VPS Containers: In Progress. Security patches are currently being deployed across all virtual private servers. Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. More information is available at https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/ You can follow upstream progress directly via the CloudLinux Incident Status Page.

4. investigating Oct 21, 2026, 10:21 PM UTC

   As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to also restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.

5. investigating Oct 21, 2026, 10:24 PM UTC

   As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.

6. identified Oct 22, 2026, 01:02 AM UTC

   PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers. PHP version upgrades for the VPS fleets are currently being performed. There is still no estimate to when this will be complete, but as soon as everything is patched and deemed functioning safely we will lift any restrictions and update accordingly.

7. identified Oct 22, 2026, 04:42 AM UTC

   The PHP version upgrades for the VPS fleets are still in progress. An accurate estimate of when function will be fully restored is not possible at this time, but services should be returning as the patching completes.

8. identified Oct 22, 2026, 10:24 AM UTC

   The PHP version upgrades for the VPS fleets are still in progress. Services should be returning as the patching completes. An accurate estimate of when function will be fully restored is not available at this time.

9. identified Oct 22, 2026, 05:10 PM UTC

   **Dedicated Servers:** Complete. Patched PHP packages addressing CVE-2026-109618 and CVE-2026-109619 have been applied across all dedicated server infrastructure. **VPS: **In Progress. Security patches are still being deployed across the VPS fleet. **Shared Hosting:** Complete. CloudLinux has released patched PHP packages for all supported versions, and these are being applied across our shared hosting servers. Source: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 Shared hosting customers may notice that the PHP version number shown on their account has not changed after patching. CloudLinux applied the security fix directly to the existing PHP builds rather than releasing new version numbers. For example, a patched PHP 8.3 will continue to report version 8.3.35 rather than 8.3.36. Third-party security scanners that check only version numbers may incorrectly flag these accounts as vulnerable. The session.upload_progress.enabled setting disabled on Oct 20 remains in place as additional hardening.

10. identified Oct 22, 2026, 06:31 PM UTC

    CWP has released version [1.21](https://control-webpanel.com/changelog), and our teams are actively pushing these updates. Dedicated servers are now receiving CWP updates by our Engineering teams, with VPS plans to follow suit shortly after. Thank you for your extended patience as your security is paramount to us.