On October 20, 2026, details of two critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) became publicly available ahead of their scheduled disclosure.

All PHP versions available on our hosting platform have now been patched against both vulnerabilities.

We have deployed the official security updates for PHP 8.2 and newer (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), as well as security patches for older PHP versions, including legacy releases.

All updates have been applied server-wide, and no action is required from customers to address these specific vulnerabilities.

Disable SpamAssassin

To disable SpamAssassin for a given email account when it is enabled globally, please follow these steps:

Go to the Mail Manager section.
Click on the Gear icon next to the email account, and select the Filters option. You can also click the number in the SA level column next to the email account. This will take you directly into the Spam and Antivirus subsection for the email account.
Click on Disable locally.

Disable SpamAssassin locally

If you wish to disable SpamAssassin altogether, go to Global mail settings > Spam and Antivirus, and click on the toggle next to SpamAssassin.

Note: Generally, we would recommend that you keep SpamAssassin enabled as it protects your mailboxes from unsolicited messages.