Is My Server Patched Against Security Vulnerabilities?

Short answer: yes. When a serious security vulnerability is announced for PHP, the Linux kernel, or any other software on our shared and managed servers, Ultra Web Hosting patches it for you, usually within hours, with no action required on your part. This article explains how our patching works and where to check the current status.

01. How we handle security patches

Security patching on our shared and managed infrastructure is centralized and automatic. You are not responsible for applying operating system, PHP, or control panel security updates on these plans. Here is what happens when a vulnerability is disclosed:

• We monitor upstream advisories continuously - PHP, CloudLinux, cPanel, the Linux kernel, and the CVE feeds. Critical items are triaged as soon as they are published.
• We patch in place where possible - most PHP and library fixes are shipped as a patched build of the same version, so your PHP version string does not change and your sites keep running exactly as before.
• We add a protective layer at the firewall and WAF - our web application firewall (ModSecurity plus Imunify360) often blocks known exploit attempts before the vendor patch is even available, so there is a safety net during the short window before a fix ships.
• We roll the patch across the fleet - every affected server is updated, not just one, and we verify the fix landed on each.

02. Where to check the current status

If a specific vulnerability is in the news and you want to confirm we have handled it, there are two places to look, in this order:

1. Announcements - for anything significant we post a notice at my.ultrawebhosting.com/announcements.php. When a patch is done, the announcement says so plainly, with the date and the CVE numbers it covers.
2. Server status - current operational notices live at my.ultrawebhosting.com/serverstatus.php. If there were an active issue related to a patch rollout, it would be listed there.

If both are clear and there is a patch announcement, you are covered. There is no need to open a ticket to confirm, though you are always welcome to.

03. What you need to do

For the great majority of our customers, the answer is nothing. To be specific by plan type:

One important distinction: a server-level patch protects the shared software stack. It does not fix a vulnerability inside your own website code. If your concern is a WordPress site that may have been compromised, that is a different problem, see How to Fix a Hacked WordPress Site and the WordPress Security hardening guide.

04. A recent example: the PHP RCE vulnerabilities

To make this concrete, in October 2026 two critical PHP vulnerabilities were disclosed (CVE-2026-109618 and CVE-2026-109619), both potentially allowing remote code execution. This is exactly the kind of issue customers worry about and ask us about.

Here is how it played out on our side, which is typical of our response to any critical flaw:

• Our web application firewall ruleset already blocked the known exploit path, giving immediate interim protection.
• The vendor shipped the fix as a patched build of the same PHP version, so every affected PHP version was corrected in place with no version bump.
• We rolled it across the fleet and verified each server, then posted an announcement confirming the patch.

If you received a scanner report or a news alert about a PHP vulnerability and want to confirm we patched it, check the Announcements page described in section 02. We post the CVE numbers and the date so you can match them exactly.

05. VPS and dedicated servers

On an unmanaged VPS or dedicated server, you have root access and full control, which also means operating system and PHP security patching is yours to manage. A few practical notes:

• Keep your OS packages current (yum update or apt upgrade on a schedule) and reboot when a kernel update requires it.
• If you use cPanel, its automatic update system handles cPanel and EasyApache PHP builds, but you still own the base OS.
• Our firewall and WAF protections are available and recommended on managed configurations.
• Not sure whether your server is managed or unmanaged? Open a ticket and we will confirm, and tell you exactly what, if anything, is on your plate.

Quick Recap

If you only remember a few things from this guide:

1. Server-level patching is ours, not yours on shared, reseller, and managed plans.
2. We patch in place, usually within hours, often with WAF protection in place before the fix even ships.
3. Check the Announcements page to confirm a specific CVE was handled, we post the numbers and the date.
4. Keep your own site code updated - a server patch does not cover vulnerabilities inside your WordPress or application code.
5. Unmanaged VPS and dedicated owners patch their own OS, open a ticket if you are unsure which you have.

Last updated October 2026 · Browse all General articles