PHP vulnerability advisory notice

Our vendors are in the process of distributing update packages, and we are applying them as they become available.

CloudLinux has confirmed they will be back-porting security patches for all PHP versions between 5.2, through to 8.5.

Additional mitigations to protect customer websites are in place across our shared hosting and fully managed VPS infrastructure, as per the recommended advice from the PHP Foundation.

We will provide additional updates as updates are available and applied.

The PHP security team have advised of an upcoming critical security release scheduled for Wednesday, October 21, 2026, at 14:00 UTC (Thursday, October 22, 2026, at 1:00 am AEDT). This release covers two critical vulnerabilities, both rated 9.2 out of 10 on the CVSS scale.

Full details have not yet been released regarding the versions impacted or the nature of the vulnerabilities, only their critical nature. More details on the impacted versions and recommended steps will be available as soon as we have more information.

You can see the official PHP team's post here: https://www.php.net/archive/2026.php#2026-10-20-1

Once we have confirmation that a patch has been released, we will be applying it ASAP.