Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Update timeline

1. investigating Oct 21, 2026, 08:42 AM UTC

   We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published. Our PHP builds come from our vendors. We'll apply their patched versions across our shared hosting and Managed WordPress servers as soon as they're released. In the meantime, we're putting additional protections in place on our servers to reduce the risk until the updates are rolled out. Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed. We'll update this notice as more information becomes available.

2. investigating Oct 21, 2026, 10:03 AM UTC

   Mitigations have been deployed fleet-wide and to customer servers that are managed by our team. We are continuing to monitor the situation closely, and are working with our upstream partners to ensure that patches are implemented as soon as they become available. We shall keep you updated throughout the process.

3. investigating Oct 21, 2026, 01:29 PM UTC

   We are continuing to monitor the situation, and are working diligently to ensure that all systems have mitigations in place in advance of applying patches released by upstream. We will share further updates in due course as and when more information is available. Thank you for your ongoing cooperation.

4. identified Oct 21, 2026, 03:08 PM UTC

   Upstream has now started releasing new versions that patch these vulnerabilities, and our team are working to get them applied to all servers and systems as soon as possible. We appreciate your ongoing cooperation and understanding, and will keep you updated.

5. identified Oct 21, 2026, 04:56 PM UTC

   Our team are continuing to roll out mitigations as quickly as possible, and we are deploying patched versions as and when they are released by upstream. Your ongoing patience and cooperation is greatly appreciated.

6. identified Oct 21, 2026, 06:33 PM UTC

   We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Keeping your account secure is of the utmost importance to us, so we're updating PHP on every server as fixes become available. As part of this work, we're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot be protected against these issues. If your site uses PHP 4.4, 5.1 or 5.2, it may display errors or stop working. We will do everything we can to prevent this, but ensuring the security of our customers' sites takes priority. We will contact you if you are using one of the versions of PHP that are being retired. Thanks for your patience while we keep things safe.

7. identified Oct 21, 2026, 09:27 PM UTC

   Our upstream partners have now released patched PHP binaries for all supported PHP versions. Our team are working to apply this update across the fleet. We will provide an update once this is complete. Accounts utilising unsupported PHP versions are being moved on to the next possible supported version, to ensure that they also benefit from the mitigations. Once this is complete, unsupported versions will be disabled fleet-wide.

8. identified Oct 21, 2026, 10:10 PM UTC

   Information regarding package availability for patched PHP versions was miscommunication to us by upstream, and we are still awaiting their release. In the meantime, we have applied all available mitigations across the fleet, and continue to monitor. We will keep you updated. Thank you for your patience.

9. identified Oct 21, 2026, 11:08 PM UTC

   Our upstream partners have released patches for ea-php packages for supported PHP versions, and these are now applied across our shared server fleet. We are currently in the process of applying patches for alt-php packages and we are looking to roll these out as quickly as possible.

10. identified Oct 22, 2026, 12:45 AM UTC

    Upstream have made patched PHP packages available in their testing channel, and we are working on rolling this out fleet-wide. We will provide an update here once the new PHP versions have been rolled out. Thank you for your cooperation.

11. identified Oct 22, 2026, 02:00 AM UTC

    We are continuing to deploy alt-php updates fleet-wide. ea-php is already patched. We will provide an update once the rollout is complete. Work is starting on applying the same updates to customer servers that are managed by us.

12. identified Oct 22, 2026, 05:38 AM UTC

    Our team has now completed PHP updates across our entire fleet of shared, premium and reseller servers. Patching of managed servers remains in progress, and we will update you once that is completed.

13. identified Oct 22, 2026, 06:58 AM UTC

    PHP versions across all fleet and managed servers have now been updated to versions that patch the announced CVEs. Managed WordPress (Onyx) is in progress, and we will update you in due course.

14. identified Oct 22, 2026, 08:16 AM UTC

    The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change. ** Patched servers will still report the same PHP version (5.2–8.5) as before, but are running the fixed build. ** ** There's no need to change your PHP version or contact us to confirm your site is protected. ** Patching on Onyx is still in progress, and we'll update this notice once it's complete.

15. identified Oct 22, 2026, 12:53 PM UTC

    cPanel/WHM users - all services have now been patched - no further action is required. Important notes below: ** Patched servers will still report the same PHP version (5.2 – 8.5) as before, but are running the fixed build. ** ** There's no need to change your PHP version or contact us to confirm your site is protected. ** Onyx Users: We are still working through the patches on Onyx. We are working as quickly as possible and appreciate your continued patience. For those checking PHP versions, some will remain the same, others will update. See the expected version changes below: 7.4.33 → 7.4.33 8.0.30 → 8.0.30 8.1.30 → 8.1.34 8.2.24 → 8.2.35 8.3.12 → 8.3.36

16. monitoring Oct 22, 2026, 03:53 PM UTC

    PHP security update status: Complete All fleet servers have had PHP security updates applied, including cPanel/WHM (Web Hosting, Reseller Hosting and Business Hosting) & Managed VPS services. The patches were backported, so the PHP version number hasn’t changed. Onyx: all available PHP versions have been patched. See our earlier update for the version changes. No action is needed on your side - all available PHP versions are now secure. We’re still seeing a high volume of support queries, so replies may be delayed. We’re working through the backlog as quickly as we can.

17. monitoring Oct 22, 2026, 04:23 PM UTC

    PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx). We are now monitoring following the rollout. No action is required from customers for these security updates. The phpMyAdmin database management tool on Onyx remains temporarily unavailable. Its PHP update is complete, but the tool will remain offline while we move it to a new hosting environment. We are tracking this separately from the PHP security rollout and do not yet have a confirmed restoration time. We appreciate your cooperation and patience over the psat 24 hours.

18. resolved Oct 23, 2026, 12:24 PM UTC

    PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx), and we are concluding this security update notice. No action is required from customers for these security updates. Some security fixes were backported, so the PHP version displayed by your website may remain unchanged even though the fixes are installed. Onyx phpMyAdmin remains temporarily unavailable while we move it to a new hosting environment. Its PHP security update is complete; restoration is tracked separately in our phpMyAdmin maintenance notice "phpMyAdmin maintenance notice": https://krystalstatus.uk/incidents/dbharb8c. We do not yet have a confirmed restoration time. Thank you for your patience and cooperation throughout this rollout.