PHP Security status update for Layershift customers
Published: 22 October 2026 - Last updated: 23 October 2026, 09.25
What happened?
On 21 October, the PHP development team released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10.
These vulnerabilities could allow attackers to execute malicious code on affected servers without logging in. PHP powers WordPress, WooCommerce and many other websites and applications.
The fixed upstream versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Vendor-maintained PHP packages may also contain backported security fixes without displaying these version numbers.
See the official PHP security advisory for technical details and the latest guidance.
Current status: What does this mean for you?
| Service | What we've done | What you need to do |
|---|---|---|
| Fully Managed VPS | Completed initial Plesk PHP patching on 21 October. Began separate HardenedPHP updates on 22 October. | No action needed to initiate patching. Check your helpdesk tickets for completion confirmations. |
| Enscale PaaS | Applied temporary PHP mitigations and published patched Apache PHP, Nginx PHP and LEMP templates. Further templates are being prepared. | Identify affected nodes and apply the relevant updates or mitigations below. |
Important for Enscale customers: Published templates do not automatically update existing environments. Where an updated template is available, you need to redeploy your affected environment to use it.
What do you need to do?
Fully Managed VPS
We're applying PHP security updates directly to customer servers; you don't need to initiate the updates yourself.
There are two separate sets of updates:
- Plesk PHP: Security updates for PHP 8.2 and later, with deployment starting on 21 October. This has now been completed.
- CloudLinux HardenedPHP (alt-php): Updates for older PHP versions covered by extended lifecycle support, with deployment starting on 22 October. We are currently about 85% completed.
Updates are installed server by server. PHP handlers restart briefly during installation, and server load may temporarily increase. No other observable service disruption is expected, although unexpected issues are possible.
We'll notify you through your individual helpdesk ticket when each set of updates has completed. You may receive separate confirmations for Plesk PHP and HardenedPHP.
If you experience any problems following an update, please contact Support.
Enscale PaaS
The action required depends on the types of nodes in your environment.
If you're running a PHP application
Check that your application is compatible with a currently supported PHP version, preferably PHP 8.3 or later. PHP 8.2 reaches end of upstream support on 31 December 2026.
If an updated template is available for your node type:
- Review Virtuozzo's Container Redeploy instructions before starting.
- Read Redeploy Preserved Data to understand how to retain application files, volumes and configuration.
- Check which custom files and directories need preserving. Data not retained during redeployment may be lost.
- Allow for compatibility testing and any necessary maintenance.
Important: Redeployment replaces the container filesystem. Make sure your application data and configuration are preserved before proceeding.
If a patched template isn't available yet, review the temporary mitigations in the official PHP security advisory.
Consider deploying BitNinja for additional protection. If you cannot adequately mitigate the risk, consider temporarily taking the affected application offline until an update is available.
Contact Support if you need help assessing your options or enabling BitNinja.
These temporary measures can reduce exposure, but they do not replace applying the necessary security patches.
If you're using a database node
Database nodes contain PHP through administration tools such as phpMyAdmin or phpPgAdmin, even when your application doesn't use PHP.
Restrict access to these administration interfaces by disabling access through the Shared Load Balancer (SLB) and/or enabling the Disable Webserver on SQL nodes add-on.
With the specified access restrictions in place, no further database-node action is required for this particular incident. Unsupported database software should still be scheduled for future upgrades.
Which nodes are not affected?
Apache and Nginx when deployed as load balancers, and application nodes using runtimes other than PHP, aren't affected by these PHP vulnerabilities.
What we've done so far
Fully Managed VPS
21 October
- Applied a temporary PHP configuration mitigation to reduce exposure while patches became available.
- Began deploying Plesk PHP security updates to customer servers.
- Sent advance notifications and individual completion confirmations.
- Imunify360 released additional WAF rules for servers running Imunify360, providing another layer of protection while patching progressed.
22 October
- Began testing and deploying CloudLinux HardenedPHP updates for older PHP versions.
- Tested updates on selected customer servers before expanding the rollout.
- Continued installation across affected servers, including customer-specific completion notifications.
The HardenedPHP rollout is more time-consuming because of the number of PHP versions and packages involved.
Enscale PaaS
21 October
- Applied
session.upload_progress.enabled=0across PHP nodes as a partial mitigation for CVE-2026-109619. - Made updated Apache PHP, Nginx PHP and LEMP templates available.
- Notified customers about the vulnerabilities and required action.
- BitNinja released WAF rules targeting the php2shell vulnerabilities.
22 October
- Identified that the initial configuration change hadn't taken effect on LiteSpeed nodes because the expected service restart had not completed.
- Forced a restart of all LiteSpeed services at 08:46 UTC to apply the change.
- Continued work with Virtuozzo to prepare and validate the remaining updated templates.
The PHP advisory identifies other possible mitigations, including measures relevant to CVE-2026-109618. These can affect application behaviour, so we're not making further configuration changes across customer environments without assessing their individual impact.
Temporary mitigations and WAF rules can reduce exposure, but they are not a long term replacement for installing the relevant security patches.
What happens next?
Fully Managed VPS
We're completing the HardenedPHP rollout, verifying successful installations and addressing any servers requiring further attention.
Customers will continue to receive individual patching confirmations through the helpdesk.
Enscale PaaS
We're preparing and validating patched templates for the remaining node types:
- LiteSpeed PHP
- LLSMP
- MariaDB, MySQL and Percona with phpMyAdmin
- PostgreSQL with phpPgAdmin
We'll notify customers when additional templates become available.
We're also reviewing options for older PHP versions. Once the immediate patching and customer communications have been completed, we intend to identify affected legacy environments and contact customers to establish whether they've upgraded, applied temporary mitigations or scheduled the necessary work.
Frequently asked questions
Have all affected servers been patched?
Fully Managed VPS: We completed the initial Plesk PHP updates on 21 October and began deploying CloudLinux HardenedPHP updates on 22 October.
HardenedPHP updates are being applied server by server, with customers receiving individual helpdesk notifications once installation is complete.
Enscale PaaS: We've published updated Apache PHP, Nginx PHP and LEMP templates. Further LiteSpeed and database-node templates are being prepared and validated.
Customers need to redeploy affected environments using the appropriate patched templates. Publishing a template does not automatically update existing environments.
Have any Layershift customers been affected by these vulnerabilities?
No. We can confirm that no Layershift customers are known to have been affected by these vulnerabilities.
Will updates interrupt my website or application?
Fully Managed VPS updates require brief PHP handler restarts and may temporarily increase server load.
Enscale redeployments, particularly when moving between major PHP versions, may require application changes and planned maintenance.
What if my application cannot run on a newer PHP version?
Our Fully Managed VPS platform offers extended lifecycle PHP support for versions 5.4 and later through CloudLinux or Imunify360, depending on the server configuration and licensing.
For Enscale, we're assessing options for older PHP versions. We recommend planning an upgrade to a supported PHP version rather than relying on temporary mitigations or future legacy templates.
Are temporary protections enough?
No. The configuration changes and WAF rules provide additional protection against certain attack methods, but do not address every possible exploitation path. Applying the necessary security updates remains essential.
Updates and support
Page changelog
22 October 2026: Initial customer security update published.
This is an evolving security incident. The information reflects the confirmed position at the time of the last update and may change as further fixes are released and remediation progresses.
Fully Managed VPS customers receive patching updates through individual helpdesk tickets. Enscale customers receive email notifications when additional templates become available or further action is required.
For the latest official technical guidance, see the PHP security advisory.
If you have questions or need help with your environment, contact Layershift Support.
