Critical Vulnerabilities in PHP Wednesday 21st October 2026 09:11:00

We are aware that the PHP foundation have announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution.

Whilst no technical details have been made public officially, we are actively monitoring the situation and preparing for release of the patch.

Over the past 24 hours, we have been actively deploying the available security patches across our Shared Hosting and Managed Server infrastructure, including VPS, Cloud and Dedicated Servers, wherever applicable and supported.

We continue to monitor affected systems and will apply any outstanding patches as further updates become available from software vendors.

For Managed VPS, Cloud and Dedicated Server customers, where we have identified websites running older PHP versions for which no security patch is currently available, we will be contacting affected customers directly to advise on the necessary action.

We strongly encourage customers with their own servers to check which PHP versions their websites are using. If your website is running PHP 8.1 or earlier, we strongly recommend upgrading to a supported version (PHP 8.2 or later), provided your applications are compatible.

Although backported security fixes are available for certain older PHP versions, these are dependent on the vendor and cannot be guaranteed for future vulnerabilities.

Customers operating self-managed servers, or who have disabled automatic updates, should ensure the relevant security patches have been applied.

We will continue monitoring the situation and provide further updates as necessary.

Posted 2 weeks ago by john.bush

Following our earlier announcement about two critical PHP vulnerabilities that could allow remote code execution, patched versions of PHP are now available, and cPanel and Plesk have both released updates that include them.

Shared Hosting We are applying the patched PHP versions across our shared hosting platform, and we are monitoring the rollout to confirm every server is updated. You don’t need to take any action for supported PHP versions.

Dedicated Servers, VPS and Cloud If your server has automatic updates enabled, the patched PHP packages should be installed through the normal cPanel or Plesk update process. If your server is self-managed, or you have disabled automatic updates, please apply the updates as soon as possible and confirm your PHP version afterwards.

Older PHP Versions (8.1 and earlier) PHP 8.1 and earlier no longer receive official security fixes. Some vendors may backport patches, but you should not assume your version is protected.

We have put interim mitigations in place on our network, but these reduce risk rather than remove it, and they are not a substitute for a patched PHP version.

Posted 3 weeks ago by john.bush