Dear Valued Customer,

At Foxnet Cloud, the security and reliability of our customers' websites and applications remain a priority.

We would like to bring to your attention two critical security vulnerabilities recently disclosed in PHP: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities may allow unauthenticated attackers to execute malicious code on affected servers if the relevant security fixes have not been applied.

What Is the Security Issue?

The vulnerabilities affect PHP's internal memory handling and request processing. They may impact web servers running vulnerable PHP versions, including environments using PHP-FPM, Apache, LiteSpeed and other supported PHP execution methods.

The PHP project has released security updates for the following versions:

  • PHP 8.5.12

  • PHP 8.4.27

  • PHP 8.3.36

  • PHP 8.2.35

Earlier versions may be vulnerable. PHP branches that no longer receive upstream security updates require particular attention.

What Should Customers Do?

For Shared Hosting Customers

Please keep your website's CMS, plugins, themes and application code updated. Our team is reviewing the relevant server-level security requirements and will apply necessary updates or mitigations to the managed hosting environment as appropriate.

If you have concerns about your hosting account or PHP configuration, please contact our support team.

For VPS and Dedicated Server Customers

If you manage your own VPS or dedicated server, we strongly recommend that you:

  • Check the PHP versions used by your websites and applications.

  • Install the applicable security updates provided by your operating system or PHP package vendor.

  • Review any outdated or unsupported PHP versions and plan an upgrade where necessary.

  • Ensure that your operating system, web server, CMS, plugins and applications are regularly updated.

  • Maintain current backups and monitor server logs for unusual activity.

Customers using managed server services should follow the security and maintenance arrangements included in their service agreement.

Will My Website Be Affected?

The presence of a vulnerable PHP version does not necessarily mean that your website has been compromised. However, unpatched internet-facing systems may be at risk.

Please note that a PHP version number alone may not tell the whole story, as some operating system vendors provide security fixes through backported packages. The installed package's security status should be verified with the relevant vendor.

Official Security Information

For technical details and the latest security guidance, please refer to the official PHP security release information:

https://www.php.net/archive/2026.php

Our Commitment to Security

Foxnett Digital Solutions remains committed to maintaining reliable hosting services and responding responsibly to emerging security threats. We encourage all customers to keep their websites and server environments updated and to contact our support team if they need assistance.

If you have any questions regarding this advisory or your hosting service, please open a support ticket through your Foxnett client area.

Thank you for choosing Foxnett.

Regards,
Foxnet Cloud
Technical Support Team

  • Miércoles, Octubre 21, 2026

« Atrás