We are aware of two recently disclosed critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Our team is actively working on applying the necessary security patches across our cPanel and DirectAdmin hosting infrastructure as updated packages become available from the respective vendors.

In the meantime, Imunify360 has deployed updated Web Application Firewall (WAF) rules to help detect and block known exploitation attempts, providing an additional layer of protection while the PHP updates are being rolled out.

We are closely monitoring the situation, coordinating with vendor security advisories, and prioritizing the deployment of patches across affected servers.

We will provide further updates as the patching process progresses.