Update - At this time, we are advising customers of important PHP security updates following the identification of two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities affect multiple PHP versions and may expose servers and hosted applications to security risks if left unpatched.
==== Customer Action Required ====
Customers without a Monitoring & Maintenance Agreement (MMA) are responsible for applying the required security updates to their servers.
Servers Australia will not automatically apply these updates to self-managed, unmanaged or other hosting services that are not covered by an MMA.
We strongly recommend reviewing your PHP installations and applying the necessary security updates as soon as possible.
==== Recommended Actions ====
=== Update PHP to a Supported Version ===
Review all installed PHP versions and update them to the latest compatible security release.
Where possible, we recommend upgrading to PHP 8.4 or PHP 8.5, provided your websites, applications and extensions support these versions.
As of 22 October 2026, the minimum upstream PHP releases addressing these vulnerabilities are:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
=== Apply Updates Across All PHP Installations ===
Ensure security updates are applied to all PHP installations, including PHP-FPM, command-line PHP, web server PHP handlers and associated extensions.
For servers using cPanel or CloudLinux, apply the relevant vendor-provided security updates, including backported fixes where available.
=== Update Your Server Software ===
Apply available security updates to your operating system, hosting control panel (such as cPanel/WHM), web server and associated software.
Ensure your server is running supported software versions.
=== Review Older PHP Versions ===
PHP 8.1 and older versions no longer receive security updates from the official PHP project.
Some Linux distributions and long-term support (LTS) vendors may provide backported security fixes for these older versions. If you are using an unsupported PHP version, we recommend contacting your software vendor to confirm whether the required security fixes are available or upgrading to a currently supported PHP version.
Due to the severity of these vulnerabilities, the PHP security team has also provided minimal source-level backports for:
PHP 7.4: https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
PHP 8.0: https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
PHP 8.1: https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619
These fixes are intended to assist customers who build PHP from source or do not have access to security updates through an LTS vendor.
Please note that these backports do not restore official support for older PHP versions. Upgrading to a supported version remains the recommended approach wherever possible.
=== Verify Your Websites and Applications ===
After applying updates, restart any affected services, such as Apache, PHP-FPM or LiteSpeed, as required.
Confirm your websites and applications are functioning correctly and that the relevant security fixes have been applied.
We also recommend ensuring current backups are available and reviewing server and website logs for unusual activity.
==== Need Assistance? ====
If you are unable to complete these updates yourself, the Servers Australia Support Team can assist.
Please note:
Security updates for non-MMA services will not be applied automatically.
Customers are responsible for applying the updates or requesting assistance.
Support requests are subject to your existing service agreement, and additional charges may apply.
PHP upgrades may affect compatibility with older websites and applications. We recommend ensuring current backups are available before making changes.
To request assistance, please submit a support ticket through the Servers Australia Customer Portal:
https://mysau.com.au
==== Further Information ====
For additional information about these vulnerabilities, supported PHP versions and available security updates, please refer to the following official resources.
Official PHP Website:
https://www.php.net
PHP Supported Versions:
https://www.php.net/supported-versions.php
The PHP Foundation – Today's PHP Security Release, and How We're Strengthening PHP Security:
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
We encourage all affected customers to review their environments and apply the necessary updates promptly to help maintain the security of their services.
Oct 22, 2026 - 13:37 AEDT
These vulnerabilities affect multiple PHP versions and may expose servers and hosted applications to security risks if left unpatched.
==== Customer Action Required ====
Customers without a Monitoring & Maintenance Agreement (MMA) are responsible for applying the required security updates to their servers.
Servers Australia will not automatically apply these updates to self-managed, unmanaged or other hosting services that are not covered by an MMA.
We strongly recommend reviewing your PHP installations and applying the necessary security updates as soon as possible.
==== Recommended Actions ====
=== Update PHP to a Supported Version ===
Review all installed PHP versions and update them to the latest compatible security release.
Where possible, we recommend upgrading to PHP 8.4 or PHP 8.5, provided your websites, applications and extensions support these versions.
As of 22 October 2026, the minimum upstream PHP releases addressing these vulnerabilities are:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
=== Apply Updates Across All PHP Installations ===
Ensure security updates are applied to all PHP installations, including PHP-FPM, command-line PHP, web server PHP handlers and associated extensions.
For servers using cPanel or CloudLinux, apply the relevant vendor-provided security updates, including backported fixes where available.
=== Update Your Server Software ===
Apply available security updates to your operating system, hosting control panel (such as cPanel/WHM), web server and associated software.
Ensure your server is running supported software versions.
=== Review Older PHP Versions ===
PHP 8.1 and older versions no longer receive security updates from the official PHP project.
Some Linux distributions and long-term support (LTS) vendors may provide backported security fixes for these older versions. If you are using an unsupported PHP version, we recommend contacting your software vendor to confirm whether the required security fixes are available or upgrading to a currently supported PHP version.
Due to the severity of these vulnerabilities, the PHP security team has also provided minimal source-level backports for:
PHP 7.4: https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
PHP 8.0: https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
PHP 8.1: https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619
These fixes are intended to assist customers who build PHP from source or do not have access to security updates through an LTS vendor.
Please note that these backports do not restore official support for older PHP versions. Upgrading to a supported version remains the recommended approach wherever possible.
=== Verify Your Websites and Applications ===
After applying updates, restart any affected services, such as Apache, PHP-FPM or LiteSpeed, as required.
Confirm your websites and applications are functioning correctly and that the relevant security fixes have been applied.
We also recommend ensuring current backups are available and reviewing server and website logs for unusual activity.
==== Need Assistance? ====
If you are unable to complete these updates yourself, the Servers Australia Support Team can assist.
Please note:
Security updates for non-MMA services will not be applied automatically.
Customers are responsible for applying the updates or requesting assistance.
Support requests are subject to your existing service agreement, and additional charges may apply.
PHP upgrades may affect compatibility with older websites and applications. We recommend ensuring current backups are available before making changes.
To request assistance, please submit a support ticket through the Servers Australia Customer Portal:
https://mysau.com.au
==== Further Information ====
For additional information about these vulnerabilities, supported PHP versions and available security updates, please refer to the following official resources.
Official PHP Website:
https://www.php.net
PHP Supported Versions:
https://www.php.net/supported-versions.php
The PHP Foundation – Today's PHP Security Release, and How We're Strengthening PHP Security:
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
We encourage all affected customers to review their environments and apply the necessary updates promptly to help maintain the security of their services.
Oct 22, 2026 - 13:37 AEDT
Identified - Servers Australia is continuing to respond to two recently disclosed critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which affect PHP installations across multiple operating systems and hosting environments.
Our teams are actively monitoring security advisories and patch releases from PHP, cPanel, CloudLinux, Ubuntu and other relevant vendors, and applying updates to customer servers covered by a Servers Australia Monitoring and Maintenance Agreement (MMA).
This status page will serve as the central point of information for customers regarding the progress of security updates, outstanding vendor patches and any potential service impacts.
==== Current Security Update Progress ====
=== cPanel – Non-CloudLinux Environments ===
Security updates have been applied to all applicable cPanel servers covered by an MMA that are not running CloudLinux OS.
PHP 8.2, 8.3, 8.4 and 8.5 – Security updates applied.
PHP 7.4, 8.0 and 8.1 – Backported security patches applied.
=== CloudLinux – ALT-PHP Environments ===
CloudLinux has now released security updates addressing the identified vulnerabilities for affected ALT-PHP versions across applicable operating systems.
Our team is actively deploying these updates across managed customer environments and validating that the appropriate security patches have been successfully installed.
=== Ubuntu and Other PHP Environments ===
Our team is continuing to review and apply applicable security updates for other managed PHP environments, including Ubuntu-based servers, as the relevant vendors release and confirm their patches.
==== Expected Service Impact ====
As part of this security maintenance, we will be restarting Apache, PHP-FPM and LiteSpeed web services, where applicable, to ensure security updates take effect.
These restarts may result in brief interruptions to website or application availability, typically lasting only a few seconds.
We are working to minimise disruption while prioritising the security of affected customer environments.
=== Customer Action Required ===
No action is required from customers whose affected servers are covered by a Servers Australia MMA. Our teams are coordinating and applying the necessary updates.
Customers who manage their own servers or PHP installations should review the applicable vendor security advisories and ensure relevant updates are applied as soon as possible.
=== Further Updates ===
We will continue to update this status page as additional security patches become available, outstanding updates are deployed, and our teams complete validation across the affected environments.
Need Assistance?
If you experience any issues with your website or hosted applications following this maintenance, please contact our Support Team by submitting a ticket through the Servers Australia Customer Portal.
We appreciate your patience and understanding as we undertake this important security maintenance.
Oct 22, 2026 - 12:39 AEDT
Our teams are actively monitoring security advisories and patch releases from PHP, cPanel, CloudLinux, Ubuntu and other relevant vendors, and applying updates to customer servers covered by a Servers Australia Monitoring and Maintenance Agreement (MMA).
This status page will serve as the central point of information for customers regarding the progress of security updates, outstanding vendor patches and any potential service impacts.
==== Current Security Update Progress ====
=== cPanel – Non-CloudLinux Environments ===
Security updates have been applied to all applicable cPanel servers covered by an MMA that are not running CloudLinux OS.
PHP 8.2, 8.3, 8.4 and 8.5 – Security updates applied.
PHP 7.4, 8.0 and 8.1 – Backported security patches applied.
=== CloudLinux – ALT-PHP Environments ===
CloudLinux has now released security updates addressing the identified vulnerabilities for affected ALT-PHP versions across applicable operating systems.
Our team is actively deploying these updates across managed customer environments and validating that the appropriate security patches have been successfully installed.
=== Ubuntu and Other PHP Environments ===
Our team is continuing to review and apply applicable security updates for other managed PHP environments, including Ubuntu-based servers, as the relevant vendors release and confirm their patches.
==== Expected Service Impact ====
As part of this security maintenance, we will be restarting Apache, PHP-FPM and LiteSpeed web services, where applicable, to ensure security updates take effect.
These restarts may result in brief interruptions to website or application availability, typically lasting only a few seconds.
We are working to minimise disruption while prioritising the security of affected customer environments.
=== Customer Action Required ===
No action is required from customers whose affected servers are covered by a Servers Australia MMA. Our teams are coordinating and applying the necessary updates.
Customers who manage their own servers or PHP installations should review the applicable vendor security advisories and ensure relevant updates are applied as soon as possible.
=== Further Updates ===
We will continue to update this status page as additional security patches become available, outstanding updates are deployed, and our teams complete validation across the affected environments.
Need Assistance?
If you experience any issues with your website or hosted applications following this maintenance, please contact our Support Team by submitting a ticket through the Servers Australia Customer Portal.
We appreciate your patience and understanding as we undertake this important security maintenance.
Oct 22, 2026 - 12:39 AEDT
Regions
Operational
Sydney
Operational
Brisbane
Operational
Melbourne
Operational
Perth
Operational
New Zealand
Operational
Services
Operational
Network
Operational
Private Cloud
Operational
Dedicated Servers
Operational
Cloud Servers
Operational
Firewall
Operational
Colocation
Operational
Spam Filter
Operational
Network Storage
Operational
Virtual Data Centre (VDC)
Operational
Domain Name Service (DNS)
Operational
Data Centres
Operational
Equinix SY1
Operational
Equinix SY3
Operational
Equinix SY4
Operational
Equinix BR1
Operational
Equinix ME1
Operational
Equinix PE2
Operational
Vocus - Albany
Operational
SYD2
Operational
NextDC B1
Operational
Service Desk
Operational
MySAU Customer Portal
Operational
Phone Support
Operational
Servers Australia Monitoring Platform
Operational
Servers Australia Website
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.