The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change.
Patched servers will still report the same PHP version as before, but are running the fixed build.
There's no need to change your PHP version or contact us to confirm your site is protected.
No components marked as affected
Identified
The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change.
Patched servers will still report the same PHP version as before, but are running the fixed build.
There's no need to change your PHP version or contact us to confirm your site is protected.
Identified
PHP versions across all fleet and managed servers have now been updated to versions that patch the announced CVEs.
Investigating
We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Keeping your account secure is of the utmost importance to us, so we're updating PHP on every server as fixes become available.
As part of this work, we're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot be protected against these issues. If your site uses PHP 4.4, 5.1 or 5.2, it may display errors or stop working. We will do everything we can to prevent this, but ensuring the security of our customers' sites takes priority. We will contact you if you are using one of the versions of PHP that are being retired.
Thanks for your patience while we keep things safe.
Investigating
Our team are continuing to roll out mitigations as quickly as possible, and we are deploying patched versions as and when they are released by upstream.
Your ongoing patience and cooperation is greatly appreciated.
Investigating
Upstream has now started releasing new versions that patch these vulnerabilities, and our team are working to get them applied to all servers and systems as soon as possible. We are still awaiting updates packages from some partners.
We appreciate your ongoing cooperation and understanding, and will keep you updated.
Investigating
We are continuing to monitor the situation, and are working diligently to ensure that all systems have mitigations in place in advance of applying patches released by upstream.
We will share further updates in due course as and when more information is available.
Thank you for your ongoing cooperation.
Investigating
Mitigations have been deployed fleet-wide and to customer servers that are managed by our team.
We are continuing to monitor the situation closely, and are working with our upstream partners to ensure that patches are implemented as soon as they become available.
We shall keep you updated throughout the process.
Investigating
We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published.
Our PHP builds come from our vendors. We'll apply their patched versions across our shared hosting and Managed WordPress servers as soon as they're released. In the meantime, we're putting additional protections in place on our servers to reduce the risk until the updates are rolled out.
Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed.
We'll update this notice as more information becomes available.
