Severity: CRITICAL — CVSS v4.0: 9.2/10
Current incident status: Monitoring
Latest operational update: 22 October 2026, 13:34 (UTC+2)

Latest Security Update

22 October 2026 | 13:34 (Libya time, UTC+2)

Security Patches Deployed Across Libyan Spider Managed Infrastructure

Following the emergency PHP security release, Libyan Spider has deployed the applicable fixes across its managed hosting environments.

The response has progressed from emergency protective measures to infrastructure-level security patching. Customers using managed services benefit from these updates within the applicable service scope.

Current hosting service status:

Important for JPaaS customers: Patched PHP templates are available, but running containers do not update automatically. Customers must redeploy their PHP applications using the patched image tags.

Important for legacy PHP users: Windows Shared Hosting versions earlier than PHP 8.2 will not receive updates. Managed VPS and Dedicated Server versions earlier than PHP 7.4 will not receive updates, except where applicable CloudLinux security backports are available.

Customers using these older versions should migrate to a supported, patched PHP runtime.

Libyan Spider continues security monitoring. The deployment of infrastructure-level fixes does not eliminate the need for customers to maintain their own applications and independently managed environments.

Follow the official incident updates

Current Security Status

Official security fixes have been released for both vulnerabilities.

Unpatched systems remain at critical risk. Security controls such as WAF rules can reduce exposure, but they do not replace PHP security patches.

For older PHP branches, administrators should confirm the availability of vendor-maintained security backports or migrate to supported releases.

What Are the Vulnerabilities?

PHP2Shell refers to two critical vulnerabilities affecting PHP’s core runtime:

• CVE-2026-109618: Memory corruption associated with out-of-memory handling.
• CVE-2026-109619: Unsafe reuse of internal state after memory has been freed.

These vulnerabilities may allow unauthenticated Remote Code Execution (RCE).

Applications developed using WordPress, Laravel, Drupal, Joomla and other PHP-based technologies may be exposed when running on vulnerable PHP environments.

Required Customer Actions

1. Verify your hosting environment

Identify whether your application uses managed hosting, unmanaged infrastructure, or JPaaS.

2. Confirm your PHP version

Ensure your application uses a patched PHP release or a vendor-supported security-backported package.

3. Redeploy JPaaS applications

Use the updated PHP image tags: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

4. Maintain additional security protections

Keep WAF protections enabled, prevent direct origin bypass where applicable, and review relevant security events and application logs.

5. Update application components

Continue maintaining CMS platforms, frameworks, plugins and application dependencies.

Security Timeline

All times below are Libya local time (UTC+2).

Additional Security Measures

During the initial response, Libyan Spider deployed ModSecurity protections against a publicly documented exploitation pattern while preparing for official patches.

These protections provided an additional security layer but were not considered a replacement for patching.

Customers should continue reviewing applicable Cloudflare WAF, Imunify360, and hosting-platform security controls.

Official References

• PHP Security Announcements
• CloudLinux Security Advisory
• Cloudflare WAF Changelog
• Plesk Security Advisory
• Libyan Spider — Live Incident Status

Editorial note: This advisory was first published on 21 October 2026 and is maintained as a chronological record. The latest operational update was posted on 22 October 2026 at 13:34 (UTC+2). Earlier entries retain their original context.