PHP Vulnerability Responses by Company

Nine

Global hosting
Aliases / services
Nine / nine.ch
Official website
https://nine.ch/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Managed OS / provider-managed PHP

Response status
Patchable PHP installations patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October26 final report confirms updates for managed PHP versions with available patches; users of unpatchable versions were contacted directly.

Scope: Not universal completion for every OS/PHP combination. Deploio buildpack and Dockerfile handling is separated.

What users should do

Match the official OS/PHP matrix to your system and follow individual migration guidance for unpatchable versions. Confirm coverage for self-installed PHP.

Official service URL

Source URLs

  1. https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619Response evidence
  2. https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/edithttps://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/editResponse evidence

Deploio / PHP buildpack

Response status
Buildpacks patched; rebuilds triggered
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The final report confirms patchedPHP buildpacks and rebuilds triggered for allDeploio apps.

Scope: CoversNine's PHPbuildpacks; does not establish fixes for pinnedDockerfile PHP.

What users should do

Check application behavior and activePHP after rebuilding.

Source URLs

  1. https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619Response evidence
  2. https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/edithttps://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/editResponse evidence

Deploio / Dockerfile apps

Response status
Rebuilds triggered; pinned PHP needs updates
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Rebuilds were triggered for allDockerfile apps, but pinnedPHP images require customer changes.

Scope: The notice distinguisheslatest from pinnedtags; triggering rebuilds does not prove every app patched.

What users should do

Update pins to the appropriate fixed8.2.35,8.3.36,8.4.27 or8.5.12 or later and test after rebuilding.

Source URLs

  1. https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619https://status.nine.ch/notices/nawq4jlhskhurwik-php-cve-2026-109618-cve-2026-109619Response evidence
  2. https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/edithttps://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/editResponse evidence
Related official sources
  1. Nine: PHP vulnerability responseOfficial notice

Comments