I.Web Nepal Pvt Ltd

Unlock your business’s full potential with I Web Nepal Pvt Limited

Customer support

+977-9861315370
Get In Touch
background

Blog

Critical PHP Security
Release

The majority of websites are written
in PHP, which has two significant security

What We did ?

The majority of websites are written in PHP, which has two significant security issues. On the same nite that the remedy was announced, we secured every website on our servers, so you don't need to do any action. The PHP team revealed two serious security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026. The severity rating for both is 9.2 out of 10. To put it simply, an attacker may send a website a specially constructed request and, in the worst scenario, execute their own code. They wouldn't require an account or a password. Almost all PHP websites worldwide, regardless of the hosting they use, were impacted by the weaknesses in PHP's handling of file uploads and session data. On the same day, PHP issued patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older versions, including PHP 5.6 and 7.x, require additional security because official fixes are no longer available. We didn't wait for our servers to receive the updated software. The same evening, we blocked the attack's access, and as soon as the official solutions were made available, we installed them. Every time is Nepal time.

You don't need to take any action regarding this PHP issue. Our servers already have the protection in place.These straightforward habits will also help keep your website safer from the next issue: Make sure WordPress, plugins and themes stay updated. Most of the hacked websites we see had outdated plugins running. Run a current PHP version (8.2 or newer). If your website still runs PHP 5.6 or 7.x, our firewall protects it for the time being, but those versions no longer receive security fixes. Get in touch with us and we'll help you upgrade safely. Delete any plugins and themes you don't use. Each unused plugin is one more door that has to stay locked. Use strong, unique passwords for your hosting panel, WordPress and email, and enable two-factor login wherever possible. Stay away from "free" copies of paid plugins (nulled plugins). We often find hidden backdoors inside them.

What you have to do ?

If your website shows an error or starts behaving differently, send our support team a message and we'll fix it for you.

We installed the patched PHP packages from CloudLinux, which is our server platform, on our servers. These patches address both vulnerabilities in PHP 8.2, 8.3, 8.4, and 8.5. We disabled the PHP feature that the attack relies on, across every PHP version (5.6 to 8.5) on every server. We restarted PHP and checked live websites to verify that it worked. PHP disclosed the vulnerabilities along with the versions that fix them.