Critical PHP vulnerabilities: how to protect your server and what Clouding has done
On 21st October 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed. They could allow attackers to execute malicious code remotely on affected servers. At Clouding, we want to explain the measures we have taken and reassure everyone who relies on our platform.
Our platform is protected
As soon as we learned of these vulnerabilities, we carried out an emergency security audit in addition to the many routine reviews and audits we regularly perform. Our platform does not use PHP in any critical systems, and we have already applied the relevant security updates and patches to the very few non-critical systems where PHP is used. Our platform is therefore updated and protected against these known vulnerabilities.
What should you do if you use PHP on your server?
It is important to distinguish between the security of Clouding’s infrastructure and the configuration and maintenance of each customer’s server. Security measures applied to our platform do not automatically update PHP installations on customer-managed Cloud servers.
If you have a Clouding server and use PHP, we recommend that you:
- Check your PHP version and upgrade to a secure release.
- Apply the relevant security patches as soon as possible.
- Enable backups or, at minimum, create a server snapshot as a precautionary recovery measure. These measures do not replace security updates.
Our knowledge base explains how to set these up:
If you do not enable backups, at least download and store a full backup copy of your server outside the platform so that you have an additional copy available if an incident occurs.
We can help you protect your server
We have prepared a guide in our Knowledge Base to help you check your PHP installation and apply the necessary security measures:
Need help?
If you are a Clouding customer and need guidance or assistance from our Cloud Pros team, contact [email protected]. We remain committed to providing secure, stable and reliable Cloud infrastructure.
Official source
Official PHP security advisory (21 October 2026)
Leave a Reply