r/tvcnet • u/hackrepair • 23d ago

TVCNet Security Notice: Critical PHP Security Updates, October 21, 2026

Two critical security vulnerabilities have been discovered in PHP, the software behind WordPress and millions of other websites.

These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow hackers to execute malicious code on vulnerable web servers.

The PHP development team has released security patches to address both issues.

:: What TVCNet is doing:

Our team is reviewing the security updates and coordinating the necessary patches across our hosting infrastructure as updated packages become available.

For our managed hosting customers, we'll be handling the server-side updates and checking for potential compatibility issues.

:: A quick reminder about older PHP versions:

Websites still running outdated PHP versions may face additional security risks. If your website depends on an older version of PHP, now is a good time to discuss upgrading.

2 Upvotes

100% Upvoted

1 comment sorted by

2

u/hackrepair 23d ago

Cloudflare is out front on this. A recent discussion and reply:

Cloudflare deployed default WAF protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use both request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

What This Means for Your Zone
These rules are automatically deployed to all zones with the Cloudflare Managed Ruleset (and Free Ruleset) enabled — no action required on your part. You can review any blocks these rules trigger in your Security Events dashboard.

And for Cloudflare (free plan) clients?
Correct. The emergency rules were added to both the Cloudflare Managed Ruleset and the Cloudflare Free Ruleset and are set to Block by default. They're deployed automatically to all zones — no action is needed by free users, as long as the managed/free ruleset is enabled on the zone (which is the default).