Important Security Update: PHP Security Mitigations

Shared Windows Hosting: File Upload Issue via Plesk File Manager and FTP

The Plesk upgrade has been completed, and file uploads via Plesk File Manager and FTP are now working as expected.

Kindly verify the functionality from your end. If you encounter any further issues, please contact our Support Team for assistance.

Shared Windows Hosting: Issue with File Uploads via Plesk File Manager and FTP

We are aware of an issue affecting file uploads through Plesk File Manager and FTP on some Shared Windows hosting servers.

Our technical team is actively working on resolving the issue. As part of the remediation, we are upgrading Plesk to address the underlying problem and restore normal file upload functionality.

We apologize for the inconvenience and appreciate your patience while we work toward a resolution. We will share further updates as they become available.

Thank you for your understanding.

Shared Hosting and Managed Servers: Our teams have successfully patched the servers. Mitigations remain in place as an additional layer of protection while this work is finalized.

VPS/DEDI Unmanaged Servers: As patches have been released, we have immediately applied them where possible, and file upload functionality, if impacted, will return to normal when all patches have been completed.

Please take immediate action to secure your environment. It is critical that you update your PHP to 8.2 or later, WordPress, and associated plugins to the latest version to protect your site from continued security risks.

We may have to take network action to limit the impact should we detect malicious activity on your server.

Additionally, you can reduce your exposure through restricting public access to your PHP application or leveraging WAF rules. The PHP foundation has additional info on how to limit exposure. Refer https://www.php.net/archive/2026.php#2026-10-21-5 for more details.

Please feel free to reach out to our Support team if you have any questions or require further assistance.

Dear Customer,

We’d like to share an update regarding two recently identified critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

Protecting our customers’ websites and data is a priority. As a precaution, our security and infrastructure teams applied temporary security mitigations across our shared hosting servers on 21 October 2026 while the permanent fixes are being prepared.

How might this affect your website?

As part of these temporary security measures, some website functions may experience limitations, particularly:

• Uploading larger files, such as images, videos and documents.
• Submitting larger forms or importing data.
• Restoring backups or performing website migrations.
• Installing themes or plugins that require file uploads.
• The impact may vary depending on your server and the functionality being used. Smaller uploads and routine website operations may continue to work normally.

What happens next?

Our teams are working with our software providers to deploy the appropriate security updates as soon as they become available. Once the permanent fixes are ready and installed, the temporary restrictions can be reviewed and removed.

We expect this process to take a few days, although the timeframe may vary depending on the PHP version and availability of the required updates. We’ll share further updates as more information becomes available.

We understand that these temporary limitations may cause inconvenience, and we appreciate your patience while we work to address the vulnerabilities. These measures have been implemented as a precaution to help maintain a secure hosting environment.

VPS/DEDI Unmanaged servers:

We recommend applying the patches as soon as they are made available to ensure your systems remain secure.

Servers with cPanel:Refer https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

Thank you for your understanding and for trusting us to host your websites.

Our priority remains to ensure your hosting environment stays secure while minimizing any disruption to your services.