At 14:00 UTC today, 21 October 2026, the PHP project announced two critical security vulnerabilities. Ahead of the announcement, our Ecenica Security Team put custom WAF rules in place to protect Ecenica email and website hosting customers, and we’re rolling out the fixed PHP versions across our servers now. Unless we’ve contacted you, there’s nothing you need to do.
As a general rule we rarely announce security work publicly, as it can give attackers useful information. However with this event, these vulnerabilities are already in the public domain and affect a huge share of the web, so we want you to be reassured they’re being dealt with.
What’s happened
PHP is the programming language behind WordPress and a huge share of the web. The PHP team has released updates for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated critical. You can read the full announcement in the official PHP release notice.
What we’ve done so far
Firewall protection is live. At 09:00 UTC today, we added new rules to our Web Application Firewall (WAF) that block attempts to exploit these vulnerabilities. They cover WordPress Hosting, Shared Hosting, Managed VPS and Business Email.
A firewall is an extra layer of protection, not a replacement for updating PHP itself, so we’re rolling out the fixed PHP versions as well.
| Protection | Status |
|---|---|
| WAF rules | Live |
| PHP updates | Rolling out |
What you need to do
Nothing. If your website or email is hosted with Ecenica on WordPress Hosting, Shared Hosting, Managed VPS or Business Email, we’re handling the updates for you.
The only exception is if you run PHP on a server outside Ecenica. In that case, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as you can, and check with your provider if you use an older version. If your provider can’t update and you’d like to move to one of our secure servers, place an order and we’ll help you migrate.
Questions?
Our support team is here to help. Contact support or get in touch.
