Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx). We are now monitoring following the rollout. No action is required from customers for these security updates.

The phpMyAdmin database management tool on Onyx remains temporarily unavailable. Its PHP update is complete, but the tool will remain offline while we move it to a new hosting environment. We are tracking this separately from the PHP security rollout and do not yet have a confirmed restoration time.

We appreciate your cooperation and patience over the psat 24 hours.

PHP security update status: Complete

All fleet servers have had PHP security updates applied, including cPanel/WHM (Web Hosting, Reseller Hosting and Business Hosting) & Managed VPS services. The patches were backported, so the PHP version number hasn’t changed.

Onyx: all available PHP versions have been patched. See our earlier update for the version changes.

No action is needed on your side - all available PHP versions are now secure.

We’re still seeing a high volume of support queries, so replies may be delayed. We’re working through the backlog as quickly as we can.

cPanel/WHM users - all services have now been patched - no further action is required. Important notes below:



** Patched servers will still report the same PHP version (5.2 – 8.5) as before, but are running the fixed build. **

** There's no need to change your PHP version or contact us to confirm your site is protected. **



Onyx Users:



We are still working through the patches on Onyx. We are working as quickly as possible and appreciate your continued patience.

For those checking PHP versions, some will remain the same, others will update. See the expected version changes below:

7.4.33 → 7.4.33
8.0.30 → 8.0.30
8.1.30 → 8.1.34
8.2.24 → 8.2.35
8.3.12 → 8.3.36

The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change.



** Patched servers will still report the same PHP version (5.2–8.5) as before, but are running the fixed build. **

** There's no need to change your PHP version or contact us to confirm your site is protected. **





Patching on Onyx is still in progress, and we'll update this notice once it's complete.

PHP versions across all fleet and managed servers have now been updated to versions that patch the announced CVEs.

Managed WordPress (Onyx) is in progress, and we will update you in due course.

Our team has now completed PHP updates across our entire fleet of shared, premium and reseller servers.

Patching of managed servers remains in progress, and we will update you once that is completed.

We are continuing to deploy alt-php updates fleet-wide. ea-php is already patched.

We will provide an update once the rollout is complete.

Work is starting on applying the same updates to customer servers that are managed by us.

Upstream have made patched PHP packages available in their testing channel, and we are working on rolling this out fleet-wide. We will provide an update here once the new PHP versions have been rolled out.

Thank you for your cooperation.

Our upstream partners have released patches for ea-php packages for supported PHP versions, and these are now applied across our shared server fleet. We are currently in the process of applying patches for alt-php packages and we are looking to roll these out as quickly as possible.

Information regarding package availability for patched PHP versions was miscommunication to us by upstream, and we are still awaiting their release. In the meantime, we have applied all available mitigations across the fleet, and continue to monitor.

We will keep you updated. Thank you for your patience.

Our upstream partners have now released patched PHP binaries for all supported PHP versions. Our team are working to apply this update across the fleet. We will provide an update once this is complete.

Accounts utilising unsupported PHP versions are being moved on to the next possible supported version, to ensure that they also benefit from the mitigations. Once this is complete, unsupported versions will be disabled fleet-wide.

We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Keeping your account secure is of the utmost importance to us, so we're updating PHP on every server as fixes become available.

As part of this work, we're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot be protected against these issues. If your site uses PHP 4.4, 5.1 or 5.2, it may display errors or stop working. We will do everything we can to prevent this, but ensuring the security of our customers' sites takes priority. We will contact you if you are using one of the versions of PHP that are being retired.

Thanks for your patience while we keep things safe.

Our team are continuing to roll out mitigations as quickly as possible, and we are deploying patched versions as and when they are released by upstream.

Your ongoing patience and cooperation is greatly appreciated.

Upstream has now started releasing new versions that patch these vulnerabilities, and our team are working to get them applied to all servers and systems as soon as possible. We are still awaiting updates packages from some partners.

We appreciate your ongoing cooperation and understanding, and will keep you updated.

We are continuing to monitor the situation, and are working diligently to ensure that all systems have mitigations in place in advance of applying patches released by upstream.

We will share further updates in due course as and when more information is available.

Thank you for your ongoing cooperation.

Mitigations have been deployed fleet-wide and to customer servers that are managed by our team.

We are continuing to monitor the situation closely, and are working with our upstream partners to ensure that patches are implemented as soon as they become available.

We shall keep you updated throughout the process.

We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published.

Our PHP builds come from our vendors. We'll apply their patched versions across our shared hosting and Managed WordPress servers as soon as they're released. In the meantime, we're putting additional protections in place on our servers to reduce the risk until the updates are rolled out.

Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed.

We'll update this notice as more information becomes available.