Critical vulnerabilities of October 2026: what to check on your server
Over the past few weeks, fixes were released for several widely used programs. Three of the vulnerabilities on this list are already being used in real attacks. This is a short summary of what to check, with detailed instructions in the knowledge base.
Our servers
On the shared hosting servers and in the billing system, PHP and nginx have been updated and verified on October 27, 2026. Shared hosting customers do not need to do anything. If you have a VPS or dedicated server, the updates are up to you: the server is under your control. The most important points are below.
PHP: CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
Score 9.2, remote code execution without login. CISA has added both to the Known Exploited Vulnerabilities catalog. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Note: Ubuntu, Debian and AlmaLinux backport the fix into the older version without changing its number. On a patched server, php -v will still show 8.3.6, so you need to check the package changelog. The instructions explain how.
cPanel and WHM: CVE-2026-41940
Score 9.8, panel login without a password. Attacks began in late February 2026, two months before the patch appeared. If the panel has not been updated since April 28, update it today and check whether anyone got in earlier.
nginx
The current versions are 1.30.6 in the stable branch and 1.31.7 in the mainline branch. CVE-2026-42945 ("NGINX Rift") deserves separate attention: the vendor rates it as medium severity, but it has been used in attacks since May 2026.
Nextcloud with built-in Collabora CODE: CVE-2026-110447
Score 9.2, command execution without login. Note that disabling the app does not fix the problem: you must update it to 26.4.303 or later, or remove it. Since September 10, attacks have planted web shells, so after updating you should search for leftover files.
What to do right now
- Update PHP and restart PHP-FPM. Without a restart, the old code stays in memory.
- Check the version of your control panel and update it.
- Check the nginx version.
- If you use Nextcloud, update or remove the CODE app.
- After updating, confirm that nobody got in earlier: new accounts, unfamiliar SSH keys, unfamiliar cron jobs.
Step-by-step instructions for Ubuntu, Debian, AlmaLinux, control panels and Docker, as well as checking a whole fleet of servers with a single command, are in the security section of the knowledge base. If you need help updating your server, write to support and we will help.