JetNode Applies Interim Mitigations for Critical PHP Vulnerabilities Ahead of Security Patches

Byjetnode

Preventive measures are in place across JetNode’s platform while patched PHP packages are pending.

JetNode is responding to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. All JetNode services, including Web Hosting, PaaS, Webmail, and the Customer Panel, are online and operating.

Current status

Patched PHP packages for JetNode’s platform have not yet been released. JetNode will apply them as soon as they become available. In the meantime, JetNode has put interim mitigations in place to reduce exposure to the vulnerabilities.

Interim mitigations

  • Apache has been disabled on Web Hosting servers, and all sites are now served through Nginx only.
  • PHP configuration has been hardened, including restrictions on upload progress tracking.

These mitigations reduce the risk of exploitation but are not a substitute for the official patches. JetNode is monitoring its systems closely in the meantime.

Customer data

All customer data remains intact. JetNode has found no indication that the vulnerabilities were exploited on its systems.

What this means for customers

Because Apache is temporarily disabled, .htaccess files are not currently being applied. Sites that rely on .htaccess for URL rewrites, redirects, or access restrictions may behave differently. Applications that display upload progress bars may also show reduced functionality.

Web Hosting, Webmail, and Customer Panel users do not need to take any action at this time.

PaaS customers who deploy their own container images or pin a specific PHP version are responsible for the PHP runtime in those deployments. They should rebuild and redeploy with a patched PHP release as soon as one is available for their version, or upgrade to a supported PHP version.

Customers who notice any issues, such as a website or application not behaving as expected, can contact JetNode support via support ticket.

Official information from the PHP project is available at https://www.php.net/archive/2026.php

Next steps

This post will be updated once patches have been released and applied, and when Apache has been re-enabled. We put preventive measures in place right away to limit exposure while we wait for the official patches. We’ll keep our customers informed until every system on our platform is fully patched.