On October 20, 2026, two critical security vulnerabilities in PHP became known. easyname has already applied the necessary security updates to a large proportion of the affected web hosting and managed systems. The updates have not yet been fully completed on other systems.
Current status of the security updates
The following overview shows which hosting servers have already had the security updates installed and which updates are still pending.
| Server hostname | Security update status |
|---|---|
webXX.easyname.com |
✅ Completed |
webXX.wh20.easyname.systems |
✅ Completed |
srvXXX.adino.at |
🟡 Partially completed PHP versions 7.4 and later have been updated. Older versions are still pending. |
wsXX.inname.net |
❌ Still pending |
The security updates on the older hosting servers are still partially pending:
- srvXXX.adino.at: PHP versions 7.4 and later have already been updated. Updates for older PHP versions are still pending.
- wsXX.inname.net: The required security updates have not yet been completed.
Until the respective issue has been resolved, the systems that have not yet been updated may continue to pose a security risk.
Status: October 23, 2026, 9 a.m. CEST
What happened?
The critical security vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect the PHP programming language, which is used by WordPress and numerous other web applications, among others.
Under certain conditions, these vulnerabilities can be exploited to execute code on an affected server without authorization. The vulnerabilities are in PHP itself and are not limited to easyname.
On October 21, 2026, the PHP project released security updates to fix the vulnerabilities.
Which PHP versions are affected?
The security vulnerabilities affect various PHP versions, including PHP 8.2, 8.3, 8.4, and 8.5. Older PHP versions may also be affected.
The following security updates, among others, have been released for the supported PHP version branches:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Which security fixes have already been installed on your hosting system depends on the respective server environment. The displayed PHP version number does not necessarily have to match the version numbers listed above.
What measures has easyname taken?
We have installed the necessary security updates on the affected web hosting and managed systems where the overview above indicates that the updates are completed.
On servers with the hostname pattern srvXXX.adino.at, the security fixes for PHP versions 7.4 and later have already been installed.
The corresponding security updates are still pending on the remaining systems that have not yet been fully updated.
You can find the current progress and information about the completion of the work in our status update on the PHP vulnerabilities.
Has your PHP version changed?
No. On systems that have already been updated, we installed the security updates for the PHP version being used. Your website was not automatically switched to a different PHP version.
This allows us to avoid compatibility problems that a version change could cause, for example, with your content management system, plugins, themes, or custom applications.
Why does my monitoring still show the same PHP version?
For the PHP packages we provide, security fixes are incorporated into the existing PHP version through a process known as backporting.
The displayed PHP version number remains unchanged. Only the internal package release version is increased.
The security updates that have already been completed were also installed this way. Therefore, external testing tools or the PHP information page phpinfo() may continue to show the same PHP version number as before the update.
On systems that have already been updated, an unchanged PHP version number does not mean that the security updates are missing.
However, please note that the security updates have not yet been completed on all affected hosting systems. The respective update status is therefore decisive.
Do I need to do anything myself?
For regular easyname web hosting packages, easyname provides the required security updates on the server side. You do not need to change your PHP version yourself for this.
easyname will also apply the required security updates to hosting systems that have not yet been fully updated.
Regardless of this, we recommend using a current, officially supported PHP version for your website and regularly updating the applications you use.
What applies to self-managed servers?
If you manage your own VPS, CloudServer, or RootServer, you must install the required security updates yourself or verify that they have been successfully installed.
Where can I find current information?
You can find all current information about the progress of the security updates, affected hosting systems, and the completion of the work in our status update on the PHP vulnerabilities.
Further technical information about the vulnerabilities and the released security updates can be found in the official security advisory from the PHP project.