Two critical vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619—were recently disclosed. Under certain circumstances, they could allow an unauthorised attacker to run code on a server through a specially crafted web request.
We understand that news like this can be concerning. We want to reassure you that the affected PHP environments across our managed hosting platforms have been protected and patched.
Our technical teams acted quickly to:
These measures address both vulnerabilities and provide additional layers of protection.
No action is required. Your hosting environment has been updated and verified.
You may notice that your visible PHP version number has not changed. Some shared-hosting platforms use backported security fixes: the security patch is applied to the existing PHP version without changing the version number displayed within your account or website.
For example, a site displaying PHP 7.4 or PHP 8.4.26 may still be running a fully patched build. In these cases, the PHP version number alone is not a reliable indicator of whether the security fix has been installed.
Some online PHP version checkers may incorrectly report a backported build as vulnerable because they cannot see the underlying package update.
No action is required. We have updated Managed WordPress sites to PHP 8.2 or later so they have received the relevant security fixes.
You can confirm your site’s active PHP version in WordPress:
Tools → Site Health → Info → Server → PHP version
Our managed shared-hosting and Managed WordPress platforms are protected against CVE-2026-109618 and CVE-2026-109619.
Additional firewall and platform protections remain in place as a further safeguard.
You do not need to make any PHP changes yourself.
If you have questions about your hosting environment, our support team is here to help.
