PHP security vulnerabilities – customer update
Ongoing · last updatemonitoringOct 22 · 15:43 UTC
On 20 October 2026, the Global PHP Security Team announced two critical security vulnerabilities. The official security updates were released the following day. Since millions of websites worldwide rely on PHP, the announcement understandably caused concern, and we received a large number of questions from our customers. Rightly so: the security of your website is extremely important. The good news? We took immediate action. Teams have been working non-stop to address the issue, taking mitigating measures where possible while waiting for the official software patches, and rolling out those patches as soon as they became available. All systems that could have been impacted on our hosting & company platforms have now been patched. Not every website runs on the latest PHP version. Some still use older versions, for example because certain plugins or applications are incompatible with a newer PHP release. Our teams went the extra mile and also adapted the security fixes for some older PHP versions. This process is called backporting: adapting a security patch so it also works with an older software version. It’s not simply a matter of copying a file. Our engineers have to manually implement, compile and test the necessary changes. The PHP project currently officially supports versions 8.2 through 8.5. Older versions no longer receive regular security updates. It goes without saying though, if you are on an older version of PHP, please update this.
Reported by Namesco Limited on their status page.