Last updated: 22 October 2026<\/strong> On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities:<\/p>\n\n\n\n Both vulnerabilities were rated 9.2 out of 10 in severity and could potentially allow attackers to execute malicious code on affected systems.<\/p>\n\n\n\n These are industry-wide vulnerabilities affecting PHP itself, rather than an issue specific to our hosting services.<\/p>\n\n\n\n Our Systems and Development teams have been working extensively to apply the necessary security updates across our hosting infrastructure.<\/p>\n\n\n\n If you’re using our shared or reseller hosting services, no action is required from you to address these particular PHP vulnerabilities.<\/strong><\/p>\n\n\n\n We’ve applied the relevant security updates at server level, including fixes for older PHP versions provided through CloudLinux.<\/p>\n\n\n\n You do not need to change your PHP version specifically because of this security announcement.<\/strong><\/p>\n\n\n\n For other hosting services, the situation depends on the platform and PHP version you’re using. We’ve explained the differences below.<\/p>\n\n\n\n Our teams worked throughout the evening of 21 October and overnight to apply security patches and additional protections across our hosting platforms.<\/p>\n\n\n\n The relevant PHP security updates have been applied across our cPanel, Plesk and DirectAdmin infrastructure.<\/p>\n\n\n\n CloudLinux has also provided backported security fixes for older PHP versions, covering PHP 5.2 through to 8.5<\/strong> through its PHP Selector.<\/p>\n\n\n\n This means customers running older PHP versions, such as PHP 5.6, 7.2 or 7.4, are covered against these particular vulnerabilities when using the patched CloudLinux packages.<\/p>\n\n\n\n No PHP version change is required to address these vulnerabilities on our patched shared hosting services.<\/strong><\/p>\n\n\n\n Although we generally recommend using newer, supported PHP versions for long-term security and compatibility, there is no need to rush into changing an existing, working website because of this announcement.<\/p>\n\n\n\n Security updates have been applied to PHP versions 7.4 through to 8.5<\/strong> across our updated Scout, JCP and ULTRA Cloud platform.<\/p>\n\n\n\n Customers running these patched versions do not need to change their PHP version specifically because of these vulnerabilities.<\/p>\n\n\n\n Some older PHP versions and legacy server environments have not received the latest patches.<\/p>\n\n\n\n For JCP customers, we’ve introduced a new PHP column to help identify which PHP versions your websites are using.<\/p>\n\n\n\n Any PHP versions highlighted in red have not received the necessary security patches and require attention.<\/strong><\/p>\n\n\n\n We recommend reviewing these websites and planning an upgrade to a patched PHP version.<\/p>\n\n\n\n Temporary security measures have been applied where possible, and we’re contacting affected customers directly where further action is required.<\/p>\n\n\n\n For Windows servers maintained by our team, PHP versions 8.2 through to 8.5<\/strong> have received the relevant updates.<\/p>\n\n\n\n Older versions may currently be covered by temporary mitigations only, and we’re contacting affected customers where appropriate.<\/p>\n\n\n\n If you operate an unmanaged Windows server or another customer-managed server, you’ll need to check and apply the appropriate PHP security updates yourself.<\/p>\n\n\n\n Some customers have noticed that WordPress, For example, a website might report PHP 8.2.34 rather than PHP 8.2.35.<\/p>\n\n\n\n This does not necessarily mean the website is vulnerable.<\/strong><\/p>\n\n\n\n CloudLinux uses a process called backporting<\/em>, which allows security fixes to be applied to existing PHP packages without changing the version number displayed by your website.<\/p>\n\n\n\n This means an older version number can still contain the relevant security fixes.<\/p>\n\n\n\n Our teams can verify the installed packages if there are concerns about a particular server or PHP installation.<\/p>\n\n\n\n We always recommend using a currently supported PHP version wherever possible.<\/p>\n\n\n\n Older versions such as PHP 5.6, 7.2 and 7.4 are no longer supported directly by the PHP development team.<\/p>\n\n\n\n Although CloudLinux provides additional security maintenance for older versions, moving to a newer PHP release remains worthwhile for long-term security, performance and compatibility.<\/p>\n\n\n\n However, there is no need to make an urgent PHP version change on our patched shared hosting services specifically because of these two vulnerabilities.<\/strong><\/p>\n\n\n\n Changing PHP versions can sometimes cause problems with older websites, plugins or applications.<\/p>\n\n\n\n If you’re planning an upgrade, we’d recommend:<\/p>\n\n\n\n Where possible, major PHP upgrades should be tested on a staging website before applying them to the live site.<\/p>\n\n\n\n If you manage multiple websites through WHM, you can navigate to List Accounts<\/strong>, access each account’s cPanel and check its PHP version.<\/p>\n\n\n\n You can normally check your PHP version under:<\/p>\n\n\n\n WordPress Dashboard > Tools > Site Health > Info > Server<\/strong><\/p>\n\n\n\n Please remember that the version displayed may not reflect security fixes backported by your hosting provider.<\/p>\n\n\n\n In addition to applying PHP updates, we’ve introduced additional protections where appropriate.<\/p>\n\n\n\n These include updated Imunify360 firewall rules and temporary PHP configuration changes to help reduce exposure to the vulnerabilities.<\/p>\n\n\n\n Some older environments that cannot receive the latest security patches remain protected by temporary, best-effort mitigations.<\/p>\n\n\n\n These additional measures are not a guaranteed replacement for installing the appropriate PHP security updates.<\/p>\n\n\n\n Although we’ve addressed these particular PHP vulnerabilities across our patched hosting environments, this doesn’t guarantee that an individual website is free from other security issues.<\/p>\n\n\n\n We recommend that website owners continue to:<\/p>\n\n\n\n For customers using unmanaged website services, maintaining the website’s application software remains the customer’s responsibility.<\/p>\n\n\n\n Please note that updating WordPress or its plugins alone does not fix a vulnerability within PHP itself.<\/p>\n\n\n\n Customers managing their own servers or PHP installations should not assume that security updates have been applied automatically.<\/p>\n\n\n\n Please check your installed PHP packages and ensure they contain the relevant fixes for CVE-2026-109618 and CVE-2026-109619.<\/p>\n\n\n\n Where appropriate updates are not yet available, we recommend discussing upgrade options and temporary security measures with your server administrator.<\/p>\n\n\n\n For further technical information, please see:<\/p>\n\n\n\n We’ll continue monitoring developments and updating this article where necessary.<\/p>\n\n\n\n If you have concerns about a particular website or hosting service, please contact our Support team.<\/p>\n","protected":false},"excerpt":{"rendered":" What Website Owners Need to Know Last updated: 22 October 2026Please keep an eye on our status page for regular updates. On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities: CVE-2026-109618 CVE-2026-109619 Both vulnerabilities were rated 9.2 out of 10 in severity and…<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[],"class_list":["post-1439","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/posts\/1439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/comments?post=1439"}],"version-history":[{"count":11,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/posts\/1439\/revisions"}],"predecessor-version":[{"id":1450,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/posts\/1439\/revisions\/1450"}],"wp:attachment":[{"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/media?parent=1439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/categories?post=1439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudabove.com\/help\/wp-json\/wp\/v2\/tags?post=1439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Please keep an eye on our status page for regular updates.<\/p>\n\n\n\n\n
Do I need to do anything?<\/h2>\n\n\n\n
What have we done?<\/h2>\n\n\n\n
Shared hosting, reseller hosting and managed cPanel\/Plesk servers<\/h3>\n\n\n\n
Scout, JCP and ULTRA Cloud<\/h3>\n\n\n\n
Windows servers<\/h3>\n\n\n\n
Why does my website still show an older PHP version number?<\/h2>\n\n\n\n
phpinfo()<\/code> or their hosting control panel still reports a PHP version older than the official fixed release.<\/p>\n\n\n\nShould I upgrade my PHP version?<\/h2>\n\n\n\n
\n
How can I check which PHP version my website is using?<\/h2>\n\n\n\n
cPanel<\/h3>\n\n\n\n
\n
WordPress<\/h3>\n\n\n\n
What other security precautions have been taken?<\/h2>\n\n\n\n
What else should I do to keep my website secure?<\/h2>\n\n\n\n
\n
What if I manage my own server?<\/h2>\n\n\n\n
Further information<\/h2>\n\n\n\n
\n