Virtual Hosting Company has applied critical security updates to multiple servers requiring server reboots.  This includes, but is not limited to, corrections for the following highly critical security advisories:

• CVE-2026-109618 (with CVE-2026-109619, collectively known as PHP2Shell) - A remote code execution vulnerability within PHP via Out-of-Memory errors.
• CVE-2026-109619 (with CVE-2026-109618, collectively known as PHP2Shell) - A remote code execution vulnerability within PHP via global state resets.
• CVE-2026-98432 - A Linux-Kernel vulnerability related to IPv4 remote code execution, requiring a reboot of the server for security reasons.

As part of the security patches, which started last week, we've taken action as follows:

• On our Website Hosting Servers, PHP 8.2, 8.3, 8.4, and 8.5 have been updated to their latest respective releases.  Our servers have been scanned to identify any potential access that may have been granted while PHP worked on releasing a patch/fix.  No customer sites were negatively impacted during this update.
• On our Website Hosting Servers, PHP 7.4, 8.0, and 8.1 have been removed as options across the board.  The PHP Foundation has indicated that these versions of PHP have been end-of-life discontinued long enough to not justify patching.  The recommendation given is to upgrade any websites using PHP 7.4, 8.0, or 8.1 be upgraded to PHP 8.2 at a minimum.  In removing PHP 7.4, 8.0, and 8.1, all sites using those versions were transitioned to PHP 8.2 or PHP 8.3.
• On all servers, after applying the kernel updates, we've rebooted the server to ensure that the RCE for CVE-2026-98432 are unable to impact our services moving forward.

What You Need To Do

• For any of our customers using our KVM-based Virtual Machines, you'll need to directly update the kernel in your respective Virtual Machine.
• For any of our customers using our LXC-based Virtual Machines, no action is needed at this time.
• For any of our customers using our Unmanaged Dedicated Server Solutions, you'll need to take immediate action to upgrade the kernel on your Server as soon as possible.
• For any of our customers using our Managed Dedicated Server Solutions, no action is needed from you at this time.  We've directly addressed this for you.

Next Steps

Virtual Hosting Company is actively monitoring all CVE's that impact the solutions we offer.  We are actively monitoring multiple Security Advisory groups for alerts such as those listed above.