Security Update: Critical PHP Vulnerabilities Patched Across Quantazone Servers
Quantazone has completed the deployment of security updates addressing two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as php2shell. Both vulnerabilities have a reported CVSS severity score of 9.2 out of 10.
These vulnerabilities affect PHP's memory management during request processing and could potentially allow attackers to execute unauthorized code, access sensitive information, or disrupt website availability under certain conditions.
What This Means for Your Website
No action is required from clients using Quantazone-managed servers.
Our technical team has implemented the following security measures across the managed server infrastructure:
- PHP Security Patches: Deployed the applicable security fixes across supported PHP versions.
- Firewall Protection: Implemented and strengthened security rules to block known exploit attempts.
- Additional Mitigation: Applied supplementary server-level protections to reduce exposure to known attack vectors.
- Security Monitoring: Continued monitoring of traffic and server activity for suspicious patterns.
These measures provide multiple layers of protection against the identified vulnerabilities.
Do You Need to Take Any Action?
| Server Environment | Required Action |
|---|---|
| Quantazone-managed servers | No action required. Security updates and applicable protections have been deployed. |
| Self-managed VPS or dedicated servers | Update PHP to a patched version and restart the relevant PHP services. |
| Servers running outdated PHP versions | Plan an upgrade to a currently supported PHP version after verifying application compatibility. |
The patched PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or later security-fixed releases where available.
For self-managed environments, firewall rules and temporary mitigations should not be considered substitutes for installing the appropriate PHP security updates.
Our Ongoing Commitment to Security
At Quantazone, we prioritize infrastructure security, proactive vulnerability management, and operational resilience. We continue to monitor emerging threats and apply appropriate security controls to help protect our clients' websites, applications, and business data.
Quantazone-managed server clients do not need to make any changes in response to this advisory.
If you have questions about your server environment or require assistance reviewing your PHP configuration, please contact the Quantazone support team through our website quantazone.com Chat Widget.
Regards,
Quantazone Technology & Operations Team
Secure Infrastructure. Reliable Operations. Business Continuity.