PHP vulnerabilities
Two vulnerabilities have been found in PHP.
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow malformed URLs (invalid character combinations) to trigger the PHP HTTP parser to produce internal buffer misalignments that can be exploited. This happens before any .htaccess or PHP code runs, so sites using anything based on PHP, like SD, WordPress or Jumla are susceptible.
The good news is that a fix is available, with PHP offering fixed versions, and some infrastructure providers like Cloudlinux have backfitted the fix to cover earlier versions as of . Many hosting providers use CloudLinux to ensure user accounts cannot corrupt other users sites. Most reputable hosting providers will have incorporated fixed versions of PHP already. The problem sites will be those that are running on unmaintained computers with outdated versions of PHP and other software.
The vulnerabilities were found in code over a decade old, and largely unvisited since then. While that code will be getting overdue examination and testing with modern tools, and using AI to rapidly test multiple combinations of parameters, the downside is that that will most likely bring to light many other vulnerabilities. However, those will also likely be fixed very quickly before any damage can be done.
There is nothing SD or any other PHP-based sites could do to protect against these types of vulnerabilities. Once exploited, any sites running under the user account are unprotected from the exploiters, though if they do not do any damage to site files, sites will still run as normal. The sensible approach is to regularly download archive files of the site's content, so that if a site is compromised, SD can be reinstalled and an archive used to overwrite the the installed bare site.
Vulnerabilities of such magnitude are rare, and notwithstanding similar ones being found as a result of these new ones, PHP is still fairly rock-solid with not many viable alternatives.