Today (10-21-2026) two of the largest vulnerabilities in the history of the internet were disclosed. CVE-2026-109619 and CVE-2026-109618 affect all versions of PHP above 5.4 (which is pretty much every version of PHP) which allows remote attackers to hack into a server running PHP.

It’s estimated that 70% of internet’s websites run on PHP, and at least 95% of Brownrice customer websites run PHP. With the advent of AI the speed at which vulnerabilities like this can be exploited has turned from weeks and months to hours and days. This blog is currently vulnerable, brownrice.com is currently vulnerable, and if your website is hosted on our servers, it’s also vulnerable. (Update: Nearly everything is now patched or mitigation is in place.) So our entire staff is 100% dedicated to this issue.

We’ll be updating this blog with frequent updates, so check here to see the latest. As our team’s focus is 100% on protecting your websites we will only be providing updates here, and not through our normal support channels.

10/21/2026 @9:10pm: Mitigation and patch update: php.ini mitigation for our CentOS 7 SmartVPSs is complete, as are those on dedicated managed servers. We’re still patching our AlmaLinux SmartVPSs and will be working through our Managed dedicated server SmartVPS customers as the evening’s work continues. Our customer facing SmartVPSs are approximately 95% secured now.

10/21/2026 @7:55pm: Mitigation and patch update: php.ini mitigation for our CentOS 7 SmartVPSs is complete. We’re still patching our AlmaLinux SmartVPSs and will be working through our Managed dedicated server SmartVPS customers as the evening’s work continues. Our customer facing SmartVPSs are approximately 85% secured now.

10/21/2026 @6:40pm: Mitigation and patch update: We’re rolling out php.ini mitigation for our CentOS 7 SmartVPSs now. This rollout will likely take most of the evening, but once complete will wrap up our initial security rollout for these two PHP vulnerabilities across our managed customer network.

10/21/2026 @4:35pm: Mitigation and patch update: We’ve completed php.ini mitigation for all Gen6 SmartVPSs and all Webcam Player servers. We’ve completed about 50% of the Gen7 AlmaLinux PHP patches. Next up is to apply php.ini mitigation change to Gen7 CentOS SmartVPSs. And the last thing for today will be to apply php.ini mitigation changes to our old shared hosting servers.

10/21/2026 @4:25pm: PHP mitigation updates to all webcam player servers are complete. These settings should protect our webcam player customers until we can recompile and patch each version of PHP. The standard php.ini settings (see below) have been applied, webservers restarted, and php settings confirmed.

10/21/2026 @4:00pm: PHP mitigation updates to all Gen6 SmartVPSs are complete. These settings should protect our Gen6 customers until we can either upgrade those customers to Gen7 AlmaLinux servers or recompile and patch each version of PHP. These are the php.ini settings that have been applied.

session.upload_progress.enabled Off
memory_limit -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_vars = 1000
max_input_nesting_level = 32
max_file_uploads = 10

10/21/2026 @3:20pm: Currently rolling out PHP mitigation updates to all Gen6 SmartVPSs. We’ve tested all of the php.ini setting updates and are now rolling these out to all Gen6 SmartVPSs.

10/21/2026 @1:50pm: Gen7 AlmaLinux PHP patches are being applied now. Our customers on Gen7 AlmaLinux SmartVPSs are receiving patched versions of PHP now, across all versions of PHP. We anticipate this taking the rest of the day to roll out as we have thousands of VPSs to update.

10/21/2026 @1:30pm: Currently testing PHP mitigation on Gen6 SmartVPSs. Testing so far is going well on these older servers which may not be able to receive PHP patches. If we find continued success in testing we’ll roll them out to all Gen6 SmartVPSs in the coming hours. PHP setting changes are these:

php_admin_flag session.upload_progress.enabled Off
php_admin_value memory_limit -1
post_max_size = 8M
upload_max_filesize = 4M
max_input_vars = 1000
max_input_nesting_level = 32
max_file_uploads = 10

10/21/2026 @1:08pm: Cloudflare is an option, even the free version. If you or your developer has DNS experience then moving your DNS to Cloudflare and routing all of your traffic through Cloudflare can provide you with some level of protection. We can’t help you with this as we’ve got all hands on deck patching servers so we do recommend that you work with someone with DNS experience. Here’s our FAQ on how to set this up: https://support.brownrice.com/content/2/369/en/how-do-i-use-cloudflare-cdn-with-my-smartvps.html Here’s the Cloudflare notice: https://blog.cloudflare.com/php-vulnerabilities-waf-protection

10/21/2026 @12:23pm: Gen7 AlmaLinux PHP will begin updates shortly. Our customers on Gen7 AlmaLinux will automatically receive patched versions of PHP 7.4 through PHP 8.5. The download repos are understandably swamped right now but we’ll be rolling out these updates as soon as we have them downloaded and tested.

10/21/2026 @12:17pm: We use PHP-FPM for our Gen7 VPSs and receive our upstream PHP updates from the Remi repository. Remi (he’s a one-man show) who is currently on vacation, just released patch PHP-FPM versions for AlmaLinux PHP 7.4 through PHP 8.5. We’ve just donated a nice bit of Euro’s to Remi for these updates as he does this for free.

10/21/2026 @12:10pm: We’ve spent the morning researching and have met internally and have solidified our plans for patching and mitigating these vulnerabilities, which we’ll begin rolling out shortly.