PHP CVE Security Updates & Patching

Update timeline

1. identified Oct 21, 2026, 06:24 PM UTC

   We have updated the Cloud Container images for PHP 8.2, PHP 8.3, PHP 8.4 and PHP 8.5 to address the security vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. We are now rolling out these updated images across our Cloud Container servers. Automatic updates may take some time to reach all customers. If you would like to apply the update sooner, you can manually update your Cloud Container to the latest image version through the SiteHost control panel. We will provide further updates as the rollout progresses.

2. identified Oct 21, 2026, 07:38 PM UTC

   We recommend that customers running older PHP versions (PHP 8.1 or older) upgrade to a currently supported version as soon as possible. Older PHP versions that have reached end of life no longer receive security updates from the PHP project, potentially leaving websites exposed to known vulnerabilities. We will be rolling out automatic image updates to Managed Cloud Container customers only. Customers using un-managed Cloud Containers can log in to the SiteHost control panel and manually update their container to the latest available image.

3. identified Oct 21, 2026, 10:11 PM UTC

   Updated Cloud Container images are now available for: - Nginx (PHP 8.5, 8.4, 8.3, 8.2) - Apache (PHP 8.5, 8.4, 8.3, 8.2) - WordPress (PHP 8.5, 8.4, 8.3, 8.2) - Silverstripe (PHP 8.3) We are handling updates for managed Cloud Containers and will post an update once this work is finished. Because we are applying patches directly to the server, there will be a lag between the update happening and that change being reflected in the Control Panel. For unmanaged Cloud Containers, we recommend that you update images as soon as possible.

4. identified Oct 21, 2026, 10:37 PM UTC

   We have finished patching all PHP versions on all managed servers running cPanel.

5. identified Oct 21, 2026, 10:55 PM UTC

   We have finished updating all managed Cloud Containers running images with PHP 8.2 or later. Patches were applied directly to the server, and correct image versions will now be shown in the Control Panel. Please log into the Control Panel and check that your images are up to date. If you still see an 'NV' (new version) tag, either click it to start your own update or contact [email protected]. If you are running custom images, you will need to update these. For images based on one of our PHP images (eg. Apache, Nginx, WordPress), update the base version of the image, rebuild, and update it as soon as possible.

6. identified Oct 21, 2026, 11:28 PM UTC

   For managed servers running Plesk, we have: - Updated all versions of PHP from 8.2 up. - Applied the recommended mitigations to earlier versions of PHP. These are not a full solution and can affect website functionality like file uploads, so if you are running PHP 8.1 or older, we recommend updating to a newer version as soon as possible.

7. identified Oct 22, 2026, 12:50 AM UTC

   Cloud Container images with patched versions of PHP are: - Nginx: PHP 8.5, 8.4, 8.3, 8.2 - Apache: PHP 8.5, 8.4, 8.3, 8.2 - WordPress: PHP 8.5, 8.4, 8.2 - Silverstripe: PHP 8.3 For images running PHP 8.1 or earlier, we are investigating backporting patches. Those images are: - Nginx: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1, 7.0, 5.6 - Apache: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1, 7.0, 5.6 - WordPress: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1 If you are running one of these older versions, our best advice remains to update to PHP 8.2 or higher as soon as you can.

8. identified Oct 22, 2026, 01:50 AM UTC

   We have applied the recommended mitigations to all Cloud Containers running PHP 5.2-5.5, except for custom images. These mitigations are not a complete solution, and they can affect website functionality. Please test your websites, especially those with file upload functions. We still strongly advise updating to PHP 8.2 or higher as soon as possible.

9. identified Oct 22, 2026, 03:47 AM UTC

   Cloud Container web images with some older versions of PHP now have backported patches in place. These images are already applied to managed Cloud Containers. For unmanaged Cloud Containers, now is the time to log into the Control Panel and update to the latest version of the image. Our strongest advice remains to update to PHP 8.2+ as soon as possible. These backported image updates are, by necessity, more comprehensive than updates to images running PHP 8.2+. Consequently there’s a higher risk that they could affect website functionality. Please check that your sites are working as they should. Cloud Container web images with backported PHP patches are: - Nginx: PHP 8.1, 8.0, 7.4 - Apache: PHP 8.1, 8.0, 7.4

10. identified Oct 22, 2026, 09:12 AM UTC

    Further Cloud Container images running older versions of PHP now have back-ported patches in place. These updates have already been applied to managed Cloud Containers. For unmanaged containers, now is the time to log into the SiteHost Control Panel and update to the latest version of the image. Our strongest advice remains to update to PHP 8.2+ as soon as possible. These updates are, by necessity, more comprehensive than updates to images running PHP 8.2+. That means there’s a higher risk that they could affect website functionality. Please check that your sites are working as they should. This round of updates included the the below images: - Nginx: PHP 5.6, 7.0, 7.1, 7.2, 7.3 - Apache: PHP 5.6, 7.0, 7.1, 7.2, 7.3 - WordPress: PHP 7.1, 7.3, 7.4, 8.0

11. monitoring Oct 22, 2026, 09:33 AM UTC

    At this time we’ve patched all managed servers, updated Cloud Container images and made updates (or mitigation advice) available for unmanaged servers. Despite these patches and mitigations the best advice is still to update to PHP 8.2 or higher, everywhere you can. This helps ensure you get security fixes quickly, the updates are smaller and you aren’t relying on back-ported fixes. We’ll continue to monitor the situation closely and provide further patches or updates as needed.