Merlot Digital - Status

PHP Security: Critical Updates [CVE-2026-109618/109619]

Mis à jour

Providing some brief updates with regard to the 3x main upstreams of concern with regard to this.

CloudLinux are publicly sharing updates with regard to these vulnerabilities and patches via:
https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

Media Control Panel was made aware of the issues by Merlot Digital, and has published this:
https://www.mediacp.net/news/critical-security-advisory-php2shell

DirectAdmin have confirmed they will be processing this from midnight - forum musings at:
https://forum.directadmin.com/threads/critical-php-updates.82726

There is somewhat credible information that it may explicitly relate to upload_progress functionality.
Based on that, although not officially verified, we are proceeding with removing it for the time being.

Entretien

G’day,

Please be aware of forthcoming critical security updates for PHP which will be applied with haste.

We’re working with upstreams (CloudLinux, DirectAdmin, Media Control Panel, etc) to ensure prompt updates:

  • CloudLinux: #296705
  • DirectAdmin: #73089
  • MediaCP: #IQM-34518

The updates patch 2x CVSS 4.0 critical (9.2) rated vulnerabilities. It seems that PHP5, 7 & 8 (released 2004-2026) are impacted. PHP intends to release the updates at midnight Sydney time. Downstream will follow that.

“The maintainers published the advisory following the leaking of purported details, which have yet to be confirmed. The report showed a video of an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9, all of which use PHP.”

Further updates will be provided as they come to light, and as we deploy updates globally.

Cheers,
Merlot Digital

Concernant 5 services:
The Network Crew Pty Ltd (TNC)

« Merlot Digital's website «

Network: AS138521