Important Security Advisory – Critical PHP Vulnerabilities

Dear Valued Customer, We would like to inform you of an important security update regarding newly disclosed critical PHP vulnerabilities that may affect PHP-based websites, applications, and server environments. Security Advisory Summary Severity: Critical (CVSS 9.2) Security Update Release: October 21, 2026 Affected Systems: Servers and applications running vulnerable PHP versions, particularly those accessible from the public internet. Recommended Action: Apply the latest available PHP security updates as soon as possible. SolidVPS Shared Hosting & cPanel Servers For customers using our Shared Hosting services and cPanel-based servers, the necessary security patches have already been applied automatically through the applicable security update mechanisms. No additional action is required from customers for these infrastructure-level patches. However, we recommend keeping your website applications, CMS platforms, and plugins updated. Self-Managed VPS, Dedicated Servers & Custom Environments For customers operating self-managed VPS, dedicated servers, LAMP/LEMP stacks, or other third-party PHP installations, please be advised that operating system and application-level security updates remain the customer's responsibility. We strongly recommend taking the following actions: Check your installed PHP versions using php -v and verify all PHP installations, including PHP-FPM and web server integrations. Apply the latest security updates provided by your operating system, PHP repository, or control panel vendor. Restart the relevant PHP and web server services after applying updates, where required. Review any third-party applications, frameworks, and plugins for compatibility and additional security updates. Important Notice for End-of-Life PHP Versions Customers running older PHP versions, particularly PHP 8.1 and earlier, should be aware that these versions no longer receive security updates directly from the official PHP development team. Some operating systems and third-party vendors, including CloudLinux, may provide backported security patches. However, we strongly recommend planning an upgrade to a currently supported PHP version whenever possible. Additional Security Recommendations If immediate patching is not possible, consider implementing additional protections such as a Web Application Firewall (WAF), restricting unnecessary public access, and isolating legacy applications until updates can be completed. Official Security References PHP Security Announcement: https://www.php.net/archive/2026.php#2026-10-20-1 CERT-EU Security Advisory: https://cert.europa.eu/publications/security-advisories/2026-018 At SolidVPS, infrastructure security and service reliability remain a priority. While we proactively maintain the infrastructure and software under our management, customers operating self-managed environments are encouraged to review and update their systems promptly. If you have any questions, please contact our support team through your SolidVPS Client Area.