Important Security Update: PHP Security Mitigations

On 21 October 2026, two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were reported. These vulnerabilities could potentially allow attackers to execute code on a web server without authentication.

We’re pleased to share that PHP security patching has been completed across our shared Windows hosting environment to address these vulnerabilities. The affected PHP versions have been updated to their respective fixed releases.

Our teams continue to monitor the environment closely to ensure ongoing stability and security. As an additional precaution, temporary security mitigation limits have been applied while we continue working to fully mitigate the risk. These limits may temporarily affect certain file uploads, large form submissions, and backup restores.

If you notice any unusual activity on your website, such as unexpected redirects, unfamiliar administrator accounts or files you did not upload, please contact our support team immediately.

We will share further updates on this page if required. Thank you for your patience, understanding, and continued trust in us as we work to keep your hosting environment secure.

Dear Customer,

We’d like to share an update regarding two recently identified critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

Protecting our customers’ websites and data is a priority. As a precaution, our security and infrastructure teams applied temporary security mitigations across our shared hosting servers on 21 October 2026 while the permanent fixes are being prepared.

How might this affect your website?

As part of these temporary security measures, some website functions may experience limitations, particularly:

Uploading larger files, such as images, videos and documents.
Submitting larger forms or importing data.
Restoring backups or performing website migrations.
Installing themes or plugins that require file uploads.
The impact may vary depending on your server and the functionality being used. Smaller uploads and routine website operations may continue to work normally.

What happens next?

Our teams are working with our software providers to deploy the appropriate security updates as soon as they become available. Once the permanent fixes are ready and installed, the temporary restrictions can be reviewed and removed.

We expect this process to take a few days, although the timeframe may vary depending on the PHP version and availability of the required updates. We’ll share further updates as more information becomes available.

We understand that these temporary limitations may cause inconvenience, and we appreciate your patience while we work to address the vulnerabilities. These measures have been implemented as a precaution to help maintain a secure hosting environment.

Thank you for your understanding and for trusting us to host your websites.

Our commitment remains the same: keeping your hosting environment secure while minimising disruption to your services.