Following our earlier announcement about two critical PHP vulnerabilities that could allow remote code execution, patched versions of PHP are now available, and cPanel and Plesk have both released updates that include them.
Shared Hosting
We are applying the patched PHP versions across our shared hosting platform, and we are monitoring the rollout to confirm every server is updated. You don’t need to take any action for supported PHP versions.
Dedicated Servers, VPS and Cloud
If your server has automatic updates enabled, the patched PHP packages should be installed through the normal cPanel or Plesk update process. If your server is self-managed, or you have disabled automatic updates, please apply the updates as soon as possible and confirm your PHP version afterwards.
Older PHP Versions (8.1 and earlier)
PHP 8.1 and earlier no longer receive official security fixes. Some vendors may backport patches, but you should not assume your version is protected.
We have put interim mitigations in place on our network, but these reduce risk rather than remove it, and they are not a substitute for a patched PHP version.
