We are aware of two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced on October 21, 2026. These vulnerabilities may allow attackers to execute malicious code on affected systems.
------------------------------------ Actions Taken ------------------------------------ For servers running cPanel/CloudLinux and H-Sphere under our management, we have applied the available security updates and made additional PHP configuration changes to help mitigate the vulnerabilities:
session.upload_progress.enabled = 0
session.upload_progress.cleanup = Off
These configuration changes provide additional hardening alongside the security updates.
------------------------------------ Self-Managed Servers ------------------------------------- Customers who manage their own servers are responsible for applying the relevant PHP security updates and recommended PHP configuration changes.
For assistance with updating your server or applying the recommended PHP configuration changes, please contact our support team at support@cartika.com.
------------------------------------- Cloudflare Protection ------------------------------------- For domains using Cloudflare, Cloudflare has deployed Web Application Firewall (WAF) rules to help protect against known attempts to exploit these PHP vulnerabilities. This provides an additional layer of security for your website. However, we still recommend updating PHP and applying the recommended configuration changes to ensure your server is properly protected.
For managed VMs, we have applied the available PHP security updates and recommended configuration changes. For self-managed VMs, customers are responsible for applying the required PHP updates and configuration changes. If you need assistance or more info, please contact our support team at support@cartika.com.
------------------------------------- Need Assistance or Patch Verification? ------------------------------------- If you have questions about these vulnerabilities, need help determining whether your server is affected, or would like a report confirming your server's patch status, please contact our support team at support@cartika.com.
We take the security of our hosting environments seriously and have taken steps to address these vulnerabilities on the managed servers within our scope.
Thank you,
Posted Oct 21, 2026 - 23:38 EDT
This incident affected: Cartika Toronto (Shared Email, Shared Web, Shared Database, Cloud Email, Public Cloud, Access Management, Mobile VPN, Big Data, Backups, Cartika Accounts Portal) and Cartika Dallas (Shared Email, Shared Web, Shared Database, Cloud Email, Public Cloud, Access Management, Mobile VPN, Backups, Big Data).