Critical PHP security updates applied to our hosting platform

Following our earlier notice, Virgo Networks has applied the released security fixes to the PHP runtimes serving our shared-hosting websites, hosting control panels and customer portal.

The updates address two critical PHP vulnerabilities that can allow an attacker to run code remotely without logging in: CVE-2026-109618 and CVE-2026-109619.

The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. See the PHP security announcement for details.

Shared-hosting customers

The sites identified in our PHP 7.4 notices have been moved to PHP 8.3.36. We have also applied additional request and upload safeguards in line with PHP’s guidance and restarted the affected PHP services.

Please check your usual pages, administration logins, contact forms, checkout or booking features, and uploads. The current per-file upload ceiling is 24 MB; contact us if a legitimate workflow needs larger uploads. If anything behaves unexpectedly after the PHP change, please reply to your existing ticket with the page address and details.

Our PHP settings guide explains where to find your website’s PHP settings.

VPS and dedicated server customers — action required

Please update PHP within your own server immediately, or confirm that your operating-system or software vendor has supplied fixes for both CVEs. Check every PHP installation used by your websites, control panels and containers, and restart the affected services after updating.

Updates to Virgo Networks infrastructure do not update the software inside customer-administered servers. Temporary mitigations reduce some risks but do not replace the security update.

Thank you for checking your websites and helping us complete this urgent work.

Virgo Networks Support