PHP security update: Snowtech servers patched and protections in place

You may have seen the recent news about serious security flaws in PHP, the software behind WordPress and many other websites. Here’s what happened and what we’ve done at Snowtech.

If you’re on our shared hosting, we’ve already taken care of the server updates and protective settings for you.

What happened?

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed this week. These could allow an attacker to run code on an affected server without logging in.

The official PHP security updates became available early on 22 October, Australian time.

What we did

We started checking our infrastructure as soon as the announcement came through at 6:30am AEDT on 21 October, while the official fixes were still being prepared.

We identified affected servers, tested temporary measures to reduce exposure, and had those measures in place by 3pm that day, ahead of the scheduled patch release.

Once vendor updates became available, we applied them across our hosting platforms:

• cPanel shared hosting: updated by 9:30am AEDT on 22 October.

• Managed VPS servers: updates completed by 11am wherever vendor fixes were available and could be applied.

We also monitored services throughout the process. No suspicious activity relating to these vulnerabilities was identified during those checks.

What about the newer vulnerability?

PHP has since announced another issue, CVE-2026-115560, involving its session upload progress feature under an unusual combination of settings and application behaviour.

The recommended protection is already in place across our affected Snowtech hosting and managed VPS servers. It disables the PHP feature involved and protects against this particular attack path.

PHP is preparing a permanent fix for its next regular release. We’ll apply the relevant vendor updates as they become available.

Do you need to do anything?

Shared hosting customers: there’s no server patching for you to do. We’ve handled that.

Unmanaged server customers: please make sure you’ve installed the PHP security updates. You should also apply PHP’s recommended setting:

session.upload_progress.enabled = Off

for the newer vulnerability. The earlier security updates alone do not fix this latest issue.

If you need help working out what applies to your server, please open a support ticket.

Still using an older PHP version?

If your website uses PHP 8.1 or earlier, we recommend planning an upgrade to a supported version.

These versions no longer receive routine security updates directly from PHP. Some vendors provide extended fixes, but keeping your website compatible with a supported version is the better long-term option.

We’ll be contacting shared hosting customers still using older versions with more information about moving forward.

If you have any questions about your hosting or PHP version, open a support ticket and we’ll help you work through it.

Snowtech Services Support Team