What happened

On October 21, 2026, the PHP project published fixes for two critical remote-code-execution vulnerabilities affecting PHP installations that serve websites worldwide (CVE-2026-109618 and CVE-2026-109619). Because PHP powers most hosting platforms — ours included — our team treated this as an urgent, same-day maintenance event.

What we did

• Same-day audit: accounted for every hosted website and the exact PHP version behind it.
• Runtime upgrades: installed the fixed PHP releases (PHP 8.4 and PHP 8.5 — the newest, patched builds).
• Full migration: every PHP-powered website was moved to the upgraded runtimes, one maintenance cycle at a time, with no downtime reported.
• Legacy retirement: outdated PHP versions were removed from the platform entirely — not just patched, gone.
• Verification: a final system-wide check confirmed zero websites remain on any unpatched version.

What you need to do

Nothing. Your website is already running on the upgraded, secured platform. No changes are required on your part, and no action was needed during maintenance.

If you notice anything unexpected with your website, contact VistaNet support and we’ll take a look right away.

VistaNet Inc. — Hosting & IT Services • October 21, 2026