Security Update: All PHP versions patched against recent PHP vulnerabilities

All PHP versions on our servers have been patched against the two critical security vulnerabilities disclosed today, CVE-2026-109618 and CVE-2026-109619.

Here is a brief summary of what happened and how we secured your hosting environment:

What Happened

PHP is the programming language that powers over 70% of the web, including popular applications like WordPress, Joomla, and Drupal. On October 20th, preliminary details of critical security vulnerabilities leaked ahead of schedule, prompting a rush by security researchers and bad actors to locate the flaw before fixed versions could be published. A proof-of-concept exploit tool named php2shell surfaced shortly after, demonstrating potential remote compromises of vulnerable PHP applications.

How We Protected Your Site

Our team worked continuously to monitor the situation and apply multiple layers of defense:

• Preemptive Protection: Out of an abundance of caution, we temporarily took down our main website (varialhosting.com) and client portal on October 20th to display a maintenance page to protect customer data.
• Immediate Mitigations: We applied protective PHP configuration changes across our servers and updated our Web Application Firewall (WAF) rules to block exploit patterns and scanning activity.
• Backported Security Patches: To minimize the chance of unexpected complications or plugin incompatibilities that can occur with full version upgrades during an emergency, our security partner applied security patches directly to the PHP releases currently running on our servers (covering PHP 5.2 through 8.5). This ensures your environment receives the necessary protection without requiring a PHP version bump.

Current Status

• All PHP Versions Patched: Every PHP version offered on our servers is protected against CVE-2026-109618 and CVE-2026-109619.
• Services Fully Restored: Our website and client area are back online and functioning normally.
• No Compromises Detected: We have observed no signs of security breaches on our network, a status confirmed by other hosting providers using our security partner’s protections.

Thank you for your patience while our team worked to safeguard your websites. If you have any questions, please feel free to reach out to our support team.