PHP Exploit

We are aware of the newly reported security vulnerabilities affecting PHP. Our security and technical teams have been proactively responding to the issue as their top priority. We are reviewing our systems and applying relevant updates as soon as fixes are available and have been appropriately tested. We are continuing to monitor the situation closely and will take any further action necessary. Update: 22/10/26 09:50: We can confirm that all PHP versions available on our shared hosting servers have been updated with the latest applicable security patches, including back-ported security fixes for older PHP versions. As an additional precaution, while awaiting the release of these patches, our server administrators implemented recommended protective measures across our shared hosting environment. These included server-wide PHP configuration changes and additional Web Application Firewall (WAF) rules designed to help mitigate potential exploitation of the vulnerability. All relevant server-side patches and protective measures are now in place across our shared hosting network, and no further action is required from customers in relation to these server-level updates for individual websites. Should you have any further questions or concerns, please don't hesitate to contact us. Summary 23/10/2026: On 20 October 2026, the Global PHP Security Team announced two critical security vulnerabilities. The official security updates were released the following day. Since millions of websites worldwide rely on PHP, the announcement understandably caused concern, and we received a large number of questions from our customers. Rightly so: the security of your website is extremely important. The good news? We took immediate action. Teams have been working non-stop to address the issue, taking mitigating measures where possible while waiting for the official software patches, and rolling out those patches as soon as they became available. All systems that could have been impacted on our hosting & company platforms have now been patched. Not every website runs on the latest PHP version. Some still use older versions, for example because certain plugins or applications are incompatible with a newer PHP release. Our teams went the extra mile and also adapted the security fixes for some older PHP versions. This process is called backporting: adapting a security patch so it also works with an older software version. It’s not simply a matter of copying a file. Our engineers have to manually implement, compile and test the necessary changes. The PHP project currently officially supports versions 8.2 through 8.5. Older versions no longer receive regular security updates. It goes without saying though, if you are on an older version of PHP, please update this.