Critical PHP Vulnerabilities

At 3am Thursday morning (NZST) the PHP foundation released updates to fix two serious critical PHP vulnerabilities. PHP is the underlying technology upon which sites built with WordPress, Drupal, Silverstripe and most other popular website frameworks run.

These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code or steel sensitive information in affected websites. They could also cause website errors, crashes or temporary unavailability.

We applied patches for the officially supported PHP versions at about 6.30am Thursday morning. We receive patched updates for older unsupported PHP versions from our OS vendor, CloudLinux. All versions of PHP were patched by 11.30am.

We'd like to assure all our customers that you are protected against these and future vulnerabilities, even if you are still running your site on an older PHP version.

However we still strongly recommend keeping your website up to date and running on the latest PHP releases. Patches for older unsupported PHP versions can take some time to produce and will always arrive later than the official updates for current PHP releases. Keeping your site updated and running on the latest PHP version is the best way to protect against your site being hacked. If your run a site built on WordPress, Drupal, Joomla, SilverStripe or any other framework, please ensure that you update it regularly. You can change your PHP version from the "Select PHP Version" icon in our control panel. Officially supported versions are currently 8.2 or newer, however official support for 8.2 ends on the 31st December 2026.