We would like to inform you about two recently disclosed critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619 which may allow attackers to execute malicious code remotely on affected servers.
Our team is aware of these vulnerabilities and has taken the necessary actions to address them across our managed hosting services.
Please refer to the following information based on your hosting service.
1. Shared Web Hosting and Managed Server Services
We are pleased to inform you that the necessary PHP security patches have been applied to the following services:
Startup Web Hosting (SSD & NVMe) - Basic, Basic Plus, Advanced and Expert - Lite, Plus, Premium and Deluxe
Reseller Hosting - Silver, Gold and Diamond
WordPress Hosting - WP Basic, WP Lite, WP Pro and WP Advanced
Windows Web Hosting - Essential, Premium, Business and Pro
Managed Server Services - Dedicated Server with cPanel (Managed) - Dedicated Server with Plesk (Managed) - Linux KVM VPS with cPanel (Managed) - Linux KVM VPS with Plesk (Managed)
The security patches have been applied to address both reported vulnerabilities.
Please note that some PHP version numbers may remain unchanged after patching, as the security fixes are applied through a process called backporting.
No further action is required from customers under these managed services for this specific security patch.
2. Unmanaged VPS and Dedicated Server Services
For customers using the following unmanaged services:
- Linux KVM VPS (Unmanaged) - Linux OpenVZ VPS (Unmanaged) - Windows KVM VPS (Unmanaged) - Linux and Windows Dedicated Server (Unmanaged)
Please be informed that server maintenance and software security updates are managed by the customer.
We strongly advise you to take the following actions as soon as possible:
1. Check the PHP versions installed on your server. 2. Update all affected PHP versions to the latest security-patched releases provided by your PHP vendor. 3. Restart the web server and/or PHP-FPM services after applying the updates to ensure the patched PHP binaries are being used. 4. Verify that the security patches have been successfully applied.
We recommend performing these updates as soon as possible to reduce the risk of potential exploitation.
3. RunCloud VPS Services
For customers using our RunCloud VPS services, RunCloud has released security-patched PHP builds for PHP 8.2 and newer on supported Native NGINX, OpenLiteSpeed and LiteSpeed Enterprise stacks.
These patches are being rolled out automatically by RunCloud.
If your web application is currently using PHP 8.1 or older, you are required to upgrade to PHP 8.2 or newer through the RunCloud Dashboard as these older PHP versions will not receive the official security fixes through RunCloud.
Before changing your PHP version, please ensure your website or application is compatible with the newer version.
For customers already using PHP 8.2 or newer, the security patches will be applied automatically on supported stacks. Please ensure the updates have been successfully applied.
For Docker/Containerized environments, the patched builds are still pending according to RunCloud's latest announcement.
You may refer to RunCloud's official announcement for further information:
RunCloud Official Announcement
4. General Security Recommendations
Regardless of your hosting service, we recommend keeping your website applications, CMS platforms such as WordPress, plugins, and themes updated regularly.
We also encourage customers to use PHP versions that are still officially supported to maintain better security, performance, and compatibility.
We appreciate your understanding and cooperation in keeping your hosting environment secure.
Should you have any questions or require further clarification, please feel free to contact our technical support team at support@gbnetwork.my.