PHP Security Vulnerability: Protections Are In Place

Update timeline

1. monitoring Oct 21, 2026, 01:46 PM UTC

   Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date. Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available. We'll share another update once the patched builds are available.

2. monitoring Oct 21, 2026, 04:04 PM UTC

   We are currently rolling out PHP's upstream fix fleet-wide. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts. We will continue to monitor systems closely as the final upstream fixes finish deploying. The next update will be provided once the fleet-wide deployment is fully complete.

3. monitoring Oct 21, 2026, 07:55 PM UTC

   We are continuing to roll out PHP updates across all servers and PHP versions. Our systems remain closely monitored as the final updates finish deploying, and we will share our next update once the deployment is complete.

4. monitoring Oct 21, 2026, 08:43 PM UTC

   We're continuing to roll out PHP's official fix across all servers and expect it to be complete soon. Sites on PHP 8.1 and older are protected by the mitigations we deployed early, before the details were public. Security fixes for these versions, provided under our PHP Extended Support program, are being built and are expected to roll out within the next day. No action is needed on your end. We'll keep you posted and share another update as soon as the rollout is complete.

5. monitoring Oct 22, 2026, 05:59 AM UTC

   We have successfully completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure. For our remaining environments, our Operations Team is currently staging packages and running final stability tests to ensure a smooth transition. The mitigations we deployed earlier remains enforced, keeping your sites secure while we complete this final phase. No action is required on your end. We will provide another update once the full rollout has concluded.

6. monitoring Oct 22, 2026, 11:24 AM UTC

   The official PHP security updates have been applied across the bulk of our network. Operations is currently executing final staging tests and stability checks for the remaining server groups before completing the final deployment phase. All active threat mitigations implemented previously remain live, maintaining full coverage for your application environment. No intervention is needed on your end, and we will send out a notification upon final rollout completion.

7. monitoring Oct 22, 2026, 06:12 PM UTC

   PHP Security Vulnerability: Protections Are In Place - The official PHP security updates have been applied across the entirety of our network. All active threat mitigations implemented previously remain live, maintaining full coverage for your application environment. No intervention is needed on your end.