22 October 2026
On 21 October the PHP project announced two critical security vulnerabilities in PHP. PHP is the software that runs most websites, including WordPress, WooCommerce and Joomla. The flaws could let an attacker run code on a website without logging in.
What we did
- Since 21 October, the Imunify360 firewall on all our servers has blocked the known attack. This protected websites while the fix was being prepared.
- When the fixed PHP versions were released, we installed them on all our hosting servers.
- We checked every PHP version on every server to confirm it contains the fix.
- We restarted the web servers so all websites now run the fixed version.
- We switched off two very old PHP versions (4.4 and 5.1) that will not receive a fix. No websites were using them.
What you need to do
Nothing. Your website keeps running on the same PHP version as before, and no changes are needed on your side.
If you manage your own server and would like help updating PHP, please contact support.