On 21 October 2026, the PHP Project announced two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP-based websites worldwide, including those hosted by xneelo.
We acted quickly to protect our customers. Before the official security patches became available, we put additional protections in place to reduce the risk of exploitation. Our web application firewall running on all managed servers provided an additional layer of defence, and as soon as the security updates were released, we applied them across our hosting servers.
As a general precaution, we recommend that you keep your website software up to date. If you notice any unusual activity, ask your web developer to:
- Review your CMS administrator accounts, plugins and extensions for anything unfamiliar.
- Check your website files for unexpected changes or unfamiliar files, particularly in upload directories.
- Change your website administrator and FTP passwords if you suspect unauthorised access, and enable two-factor authentication where available.
- Update your CMS, plugins, themes and other website software to the latest versions.
- Check for scheduled tasks (cron jobs) you don’t recognise.
