Dear Valued Users,
The PHP development team has officially disclosed two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS v4.0 severity score of 9.2 (Critical). These vulnerabilities could potentially allow unauthenticated attackers to execute malicious code on affected servers.
At Babal.Host, we proactively monitor upstream security advisories and act promptly to safeguard our hosting infrastructure and user websites.
We are pleased to confirm that our technical team has already implemented proactive server-level security protections across our managed shared hosting infrastructure to address these vulnerabilities.
What does this mean for our users?
1. Shared Hosting users (cPanel/CloudLinux)
The necessary server-level security measures have already been implemented across our managed shared hosting environment.
No action is required from users for these server-level protections.
Please note that security patches are sometimes backported by upstream vendors to existing PHP versions. As a result, the PHP version displayed in your hosting control panel may remain unchanged even after the relevant security fixes have been applied.
2. PHP Version Recommendations
Although older PHP versions may continue receiving security fixes through vendor-supported backporting, we strongly recommend upgrading to PHP 8.4 or newer, wherever your website or application supports it.
Keeping your website on a modern PHP version helps improve security, performance, compatibility, and long-term stability.
Users running end-of-life PHP versions should prioritize upgrading their applications wherever possible.
3. VPS and Self-Managed Server Users
Users operating self-managed VPS or dedicated servers should ensure that the latest applicable security updates are installed through their respective operating system, PHP distribution, or control-panel vendors.
Unlike our managed shared hosting environment, security updates on self-managed servers remain the responsibility of the server administrator unless a separate management arrangement is in place.
Official References
-
PHP Security Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
-
CloudLinux Security Advisory: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
-
cPanel EasyApache 4 Changelog: https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/
Our Commitment to Security
Security is an ongoing responsibility, not simply a response to newly discovered vulnerabilities.
Our infrastructure team continuously monitors security developments, applies necessary protections, and maintains our managed hosting environments in accordance with upstream vendor recommendations.
We remain committed to addressing critical security concerns proactively while minimizing disruption to our users.
For any questions or assistance regarding your hosting environment, please feel free to reach out to our support team.
With best wishes,
Babal.Host team
