October 2026 PHP Vulnerabilities

https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

On Wednesday 21st October, it was announced there were 2 serious bugs in the tools used to run software written in PHP - the language most websites hosted on our platform has been written in. We're not aware of these vulnerabilities having been taken advantage of for any of our customers - and due to the way our hosting platform is set up, each site on our platform would have to be attacked separately - an attack on one site, would not automatically give access to sites belonging to other customers.

A patch for these vulnerabilities was made available by the PHP project for supported PHP versions (8.2 and newer) around 14:40 yesterday. These then had to be prepared by our hosting panel vendor to work with the hosting panel before we could install them. These were made available by the vendor at 3:40PM and installed on the hosting platform by 3:45PM.

Our hosting panel vendor, then did further work to enable release of patches for some end of life, unsupported PHP versions (7.4 - 8.1) and these were released at 11:29PM and installed on the hosting platform by 11:42PM.

Our hosting platform automatically installs security updates every evening, however due to the severity of these vulnerabilities, we ensured that they were installed manually as soon as possible after release.

Due to the severity of these bugs, our hosting panel vendor is also preparing patches for older (pre PHP 7.4) end of life and unsupported PHP versions, which we anticipate will be available by Saturday 24th October.

We strongly recommend anyone running PHP versions 8.2 and Older change to a newer PHP version in their Hosting Control Panel.

After upgrade please check your site carefully as PHP upgrades can remove features older site rely on.

If you have a designer / developer who looks after your site, you may wish to contact them prior to upgrading. If you do not please contact our support team who will be happy to test your site on a newer PHP version and report back if any changes are required.

Please note however any code or application changes are not part of our support remit. However in some cases we may be able to assist with any updates on a chargeable basis - our support team will advise if this is the case.

Managed Wordpress (WPHub) Customers do not need to take any action unless you hear directly from our support team. We handle security updates as part of your managed service.

If you are unsure which PHP version your site is running, or need assistance in changing the PHP version, please contact our support team who will be happy to help.