PHP Vulnerability Responses by Company

ServerFreak

Global hosting
Aliases / services
ServerFreak / web-hosting.net.my / Server Freak / サーバーフリーク / serverfreak.com
Official website
https://www.web-hosting.net.my/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Shared Hosting / MultiPHP Manager

Response status
Shared hosting patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official notice posted October 22 at 11:42 reports both CVE fixes across all shared hosting servers, covering PHP 5.2 and later. CloudLinux and Imunify360 backports may retain displayed versions.

Scope: This result covers shared hosting. The managed-server statement covers PHP 8.2 and later; self-managed systems require customer action.

What users should do

Confirm your shared-hosting scope rather than judging by the version number alone. Check separate conditions for managed servers and environments you operate yourself.

Official service URL

Source URLs

  1. ServerFreak: PHP configuration and operationhttps://www.web-hosting.net.my/why-php-version-matters-or-your-business-website/Service and operation documentation
  2. https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619Response evidence

Managed Server (PHP)

Response status
Applicable PHP 8.2+ environments patched
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 22 notice reports applicable fixes installed on managed servers running PHP 8.2 and later. It does not establish completion for older managed-server runtimes.

Scope: Do not extend shared-hosting PHP 5.2+ coverage to managed servers.

What users should do

Verify the PHP branch and patched packages for your contracted environment. Ask support about older runtimes.

Source URLs

  1. https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619Response evidence

Self-managed Server / customer-owned Imunify360 environments

Response status
Customers verify and apply fixes
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The notice asks self-managed customers to ensure PHP security updates are installed. Customer-owned Imunify360 environments must also have the relevant PHP package fixes.

Scope: Having Imunify360 alone does not prove PHP packages are patched.

What users should do

Install the fixes for both CVEs in the PHP packages you operate and verify the running environment and application.

Source URLs

  1. https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619https://helpdesk.serverfreak.com/en/announcements/article/security-update-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619Response evidence
Related official sources
  1. ServerFreak: PHP configuration and operationOfficial information directoryPHP operational documentation.

Comments