PHP Vulnerability Responses by Company

Websavers

Global hosting
Aliases / services
Websavers / websavers.ca
Official website
https://websavers.ca/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Shared Plesk hosting

Response status
PHP7.4+ patched; older exceptions
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Shared PHP7.4 and later are patched. PHP5.x and7.0–7.3 are patched on Curry; other shared servers require switching to7.4 or later.

Scope: WAF mitigation is not a runtime fix. VPS support tiers are separate scopes.

What users should do

Check the server name if using older PHP. Outside Curry, test compatibility and switch to a patched branch.

Official service URL

Source URLs

  1. Changing PHP versions and settingshttps://clients.websavers.ca/whmcs/knowledgebase/13/How-do-I-get-a-PHP-configuration-value-changed.htmlService and operation documentation
  2. https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlhttps://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlResponse evidence

Managed VPS (support above DIY)

Response status
PHP7.4+ patched; verify older builds
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Managed PHP7.4+ is patched. Customers using5.x–7.3 must open a ticket to verify their fixes.

Scope: Plesk on8443 is patched regardless of support tier; site PHP is separate.

What users should do

Ask support to verify older PHP.

Source URLs

  1. https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlhttps://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlResponse evidence

VPS with DIY support

Response status
Customer verifies and installs fixes
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Automated sweeps may have installed fixes, but DIY customers must verify and install PHP patches.

Scope: Patched Plesk8443 does not establish patched site PHP.

What users should do

Check actual packages and changelogs, then update as needed.

Source URLs

  1. https://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlhttps://clients.websavers.ca/whmcs/announcements/83/Vulnerability-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619---Patches-Applied.htmlResponse evidence
Related official sources
  1. Changing PHP versions and settingsOfficial information directoryOfficial documentation for PHP operation or the supplied service.

Comments