PHP Security Update – 21st October

Last updated: 22 October 2026

A security issue affecting PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), was announced on 21st October 2026. We have applied the fix to all of our servers, for all PHP versions, including older and end-of-life versions.

Your websites are patched and protected. You don’t need to take any action.

Timeline

• 20th October, evening: We put a protective measure in place on all servers to mitigate the vulnerability while the official fix was being prepared.
• 21st October, morning: Firewall rules were deployed to protect customers against this vulnerability.
• 21st October, 3pm: The official PHP security fix was released.
• 21st October, 10pm: We complete the patching process on our servers, including older and end-of-life PHP versions.

Frequently asked questions

Do I need to do anything?
No. All updates have been applied for you. There’s nothing to install, update or restart.

Is it safe to use an older PHP version?
Yes. All PHP versions on our servers, including older ones, have been patched. We still recommend PHP 8.2 or newer for the best performance and compatibility.

Why hasn’t my PHP version number changed?
The fix was applied without changing the version number. For example, your site may still show 8.3.35 instead of 8.3.36. This is expected, and your site is still patched.

Can I update to the newer version number myself?
No, and you don’t need to. The version you’re on already contains the fix.

WordPress or a security plugin says my PHP version is outdated or vulnerable.
These tools only check the version number, so they can’t see that the fix has been applied. Your site is protected.

How can I check my site is patched?
Follow our guide: My PHP version didn’t change after the 21st October PHP security update

Was my website affected?
We’re not currently aware of any customer websites being affected. If you notice anything unusual on your site, please open a support ticket and we’ll check it for you.