Security Maintenance: PHP Configuration Updates

As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance.

There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.

Our Systems Engineering and Security teams are continuing to deploy critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions.

Current Deployment Status by Environment:

Dedicated Servers: In Progress. Updates have been successfully applied across all dedicated server infrastructure.

VPS Containers: In Progress. Security patches are currently being deployed across all virtual private servers.

Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release.

More information is available at https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/

You can follow upstream progress directly via the CloudLinux Incident Status Page.

Our Systems Engineering and Security teams are actively deploying critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions.

Current Deployment Status by Environment:

Dedicated Servers: Resolved. Updates have been successfully applied across all dedicated server infrastructure.

VPS Containers: In Progress. Security patches are currently being deployed across all virtual private servers.

Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release.

You can follow upstream progress directly via the CloudLinux Incident Status Page.

We are applying urgent security mitigations across our server infrastructure to address recently disclosed PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619).

As part of this update, we are disabling the default PHP session.upload_progress.enabled setting. While standard platforms (including WordPress) remain unaffected, custom non-WordPress sites relying on PHP native file upload progress tracking may experience functionality changes.