Xneelo Patches Managed Hosting Servers After PHP CVEs

In Short

xneelo said it moved to protect customers after the PHP Project announced two critical security vulnerabilities affecting PHP-based websites worldwide, including sites hosted by xneelo.

What Happened

xneelo said the PHP Project announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that affect PHP-based websites.

The hosting company said it acted before official security patches were available. It put additional protections in place to reduce the risk of exploitation, meaning attackers taking advantage of the vulnerabilities.

xneelo said its web application firewall, a security filter that blocks suspicious web traffic, was running on all managed servers and provided an extra layer of defence.

Once the official security updates were released, xneelo said it applied them across its hosting servers.

Why It Matters

Security vulnerabilities in widely used website software like PHP can put many businesses at risk at the same time. For customers on managed hosting, the provider’s response can reduce exposure while users wait for upstream patches.

xneelo also shared general precautions for site owners and teams. It recommended keeping website software up to date. It said if users notice unusual activity, they should ask their web developer to review CMS administrator accounts, plugins and extensions for anything unfamiliar, check website files for unexpected changes or unfamiliar files, especially in upload directories, and change website administrator and FTP passwords if they suspect unauthorised access.

xneelo also recommended enabling two-factor authentication where available, updating the CMS, plugins, themes and other website software to the latest versions, and checking for scheduled tasks, also known as cron jobs, that users do not recognise.

For Liners readers running production websites, these steps can be a reminder that hosting-side patches help, but application-side hygiene still matters when new CVEs drop.