PHP Security Vulnerability (CVE-2026-109618 & CVE-2026-109619)

Incident Report for Liquid Web - Cloud Sites

Update

Our Engineers will be rolling out patches to the PHP versions that your websites are using at approximately 6PM EDT, and is expected to take up to 4 hours.

There is no expected downtime or service disruption during this update. No action is needed from you afterwards - your sites will be running on the same version of PHP it's currently on - just the latest, patched build.
Posted Oct 21, 2026 - 15:01 CDT

Update

We are aware of recent reports regarding two critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities may affect web servers running PHP 5.4 and later and could potentially allow remote code execution.

Our Security and Engineering teams are continuing to review our hosting environments and develop strategies to patch the vulnerability.

We are continuing to closely monitor the situation and will provide further updates as additional information becomes available.
Posted Oct 21, 2026 - 13:02 CDT

Identified

Our Security and Engineering teams are continuing to evaluate the optimal patching strategy for our hosting environments.

We are currently analyzing the security releases and testing deployment paths in our staging environments to ensure service stability. At this time, no patches or modifications have been rolled out to production systems.

Our infrastructure remains under heightened monitoring, and we will share further details here as soon as our deployment plan and maintenance windows are finalized.

If you need assistance or have any concerns, please contact our Support team.
Posted Oct 21, 2026 - 10:39 CDT

Investigating

We are aware of recent reports regarding two critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities may affect web servers running PHP 5.4 and later and could potentially allow remote code execution.

Our Security and Engineering teams are actively reviewing our hosting environments to assess potential impact. As a precautionary measure, we are implementing appropriate mitigations and working to deploy the necessary security updates across affected systems as they become available.

We are continuing to closely monitor the situation and will provide further updates as additional information becomes available.

If you need assistance or have any concerns, please contact our Support team.
Posted Oct 21, 2026 - 09:50 CDT
This incident affects: PHP Services (LAN, PHX).