Our upstream partners have now released patched PHP binaries for all supported PHP versions. Our team are working to apply this update across the fleet. We will provide an update once this is complete.
Accounts utilising unsupported PHP versions are being moved on to the next possible supported version, to ensure that they also benefit from the mitigations. Once this is complete, unsupported versions will be disabled fleet-wide.
No components marked as affected
Identified
Our upstream partners have now released patched PHP binaries for all supported PHP versions. Our team are working to apply this update across the fleet. We will provide an update once this is complete.
Accounts utilising unsupported PHP versions are being moved on to the next possible supported version, to ensure that they also benefit from the mitigations. Once this is complete, unsupported versions will be disabled fleet-wide.
Identified
We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Keeping your account secure is of the utmost importance to us, so we're updating PHP on every server as fixes become available.
As part of this work, we're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot be protected against these issues. If your site uses PHP 4.4, 5.1 or 5.2, it may display errors or stop working. We will do everything we can to prevent this, but ensuring the security of our customers' sites takes priority. We will contact you if you are using one of the versions of PHP that are being retired.
Thanks for your patience while we keep things safe.
Identified
Our team are continuing to roll out mitigations as quickly as possible, and we are deploying patched versions as and when they are released by upstream.
Your ongoing patience and cooperation is greatly appreciated.
Identified
Upstream has now started releasing new versions that patch these vulnerabilities, and our team are working to get them applied to all servers and systems as soon as possible. We are still awaiting updates packages from some partners.
We appreciate your ongoing cooperation and understanding, and will keep you updated.
Investigating
We are continuing to monitor the situation, and are working diligently to ensure that all systems have mitigations in place in advance of applying patches released by upstream.
We will share further updates in due course as and when more information is available.
Thank you for your ongoing cooperation.
Investigating
Mitigations have been deployed fleet-wide and to customer servers that are managed by our team.
We are continuing to monitor the situation closely, and are working with our upstream partners to ensure that patches are implemented as soon as they become available.
We shall keep you updated throughout the process.
Investigating
We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published.
Our PHP builds come from our vendors. We'll apply their patched versions across our shared hosting and Managed WordPress servers as soon as they're released. In the meantime, we're putting additional protections in place on our servers to reduce the risk until the updates are rolled out.
Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed.
We'll update this notice as more information becomes available.
