Upcoming critical PHP security update

Update timeline

1. identified Oct 21, 2026, 06:02 AM UTC

   The PHP security team has announced a security release addressing two critical vulnerabilities, each rated 9.2 out of 10. The release is scheduled for 1 am Thursday 22 October 2026, Sydney/Melbourne time, but may be published earlier. Our team will review the advisory on release and apply relevant patches to our managed hosting environments. Any required maintenance or service interruptions will be communicated through this status page. Affected PHP versions, technical details and fixed versions will be published with the release. Official PHP announcement can be viewed here https://www.php.net/archive/2026.php#2026-10-20-1

2. identified Oct 21, 2026, 02:57 PM UTC

   **PHP security update — 22 October 2026** We have applied emergency mitigations to our share hosting and managed server environments while we await the corresponding vendor patches. Our team continues to monitor vendor releases and will apply security updates as they become available. PHP has confirmed that **CVE-2026-109618 and CVE-2026-109619** can allow remote code execution without authentication. Fixes have been released in **PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12**. Temporary mitigations reduce exposure but do not provide complete protection. Installing the security updates remains necessary. **Shared hosting and managed server customers:** Our team manages server-level security updates. We strongly encourage customers using **PHP 8.1 or earlier** to move to a supported, patched version. Your website developer may need to update your website, plugins or themes to ensure compatibility before switching PHP versions. Please contact support if you need guidance. **Unmanaged server customers:** You or your appointed administrator are responsible for assessing your server, applying the appropriate updates and completing any required service restarts. If you use older PHP versions through an extended-support vendor, please confirm that its packages include fixes for both vulnerabilities. Updating your website or CMS alone does not address these vulnerabilities. We will provide a further update as patching progresses. [Official PHP security advisory](https://www.php.net/archive/2026.php)

3. identified Oct 21, 2026, 09:57 PM UTC

   **PHP security update — shared hosting patching complete** We have completed the installation of vendor security updates across our shared hosting and reseller servers to address **CVE-2026-109618 and CVE-2026-109619**, following the emergency mitigations applied earlier. Shared hosting customers do not need to install these server-level updates. We continue to recommend that customers using **PHP 8.1 or earlier** work with their website developer to move to a supported PHP version. The team are continuing to work through our Managed Server clients to apply the recently released vendor updates. **Unmanaged server customers:** You or your appointed administrator remain responsible for checking and updating your server. Completion of our shared hosting updates does not apply to unmanaged services. If you experience any issues with your hosting service, please open a support ticket.

4. identified Oct 22, 2026, 01:57 AM UTC

   Critical PHP security vulnerabilities (PHP2Shell) All shared hosting servers are fully patched against both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). All cPanel managed servers are also fully patched. We are working through the remaining Managed Servers to apply vendor updates. If you run your own unmanaged server, please make sure you’ve updated PHP. Or reach out to our support team if you have any questions or need assistance. If your site uses PHP 7.2 to 8.1, we still strongly recommend upgrading to a newer version. We’ll contact affected customers over the coming days with more information.