On 20 October, two serious security vulnerabilities in PHP were announced. We immediately started preparing to install the updates on our Web hosting and Managed VPS platforms, including for older PHP versions covered by PHP Extended Support. Applicable security patches have now been deployed, and additional protective measures are in place.
What happened?
On 20 October, researchers announced two serious security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is the software behind a large proportion of websites and web applications, including but not limited to WordPress.
In some cases, these vulnerabilities could allow attackers to run their own code on the server hosting a website or web application. The issue is in PHP itself and is not specific to any particular hosting provider. This means websites using PHP could be vulnerable worldwide, regardless of their hosting provider.
What have we done?
We didn’t wait for the official security patches before taking action. As soon as we received information about the vulnerabilities, we introduced temporary protective measures on our hosting platform to reduce the risk of exploitation.
We also continuously tested our platform and systems using attack methods that appeared online. At the same time, we closely monitored traffic to our servers for suspicious activity.
As soon as the official updates became available, we rolled them out across our Web hosting, our own systems, and Managed VPS platforms. The updates were applied to customers’ existing PHP versions. We did not automatically move websites from one PHP version to another.
The incident is now resolved, applicable security patches have been deployed, and additional protective measures are in place.
Older PHP versions are protected with PHP Extended Support
The official PHP update is only available for the latest versions. Older versions no longer receive security updates from PHP.
Websites using an older PHP version with us are protected by PHP Extended Support. We’ve applied the security update to these versions as well. You don’t need to do anything or rush to upgrade to a newer version.
Has your PHP version changed?
No. We installed the security update on the PHP version you were already using. We did not automatically switch your website to a different PHP version. This is important, because a different PHP version can cause problems with your website, theme, plugins, or custom code. So your website runs exactly as you are used to, only more securely.
Do you have a VPS?
With an unmanaged VPS, you’re responsible for managing the software on your server. We strongly recommend updating PHP to the latest version as soon as possible.
Even if you didn’t install PHP yourself, it’s a good idea to check whether any software running on your server uses PHP.
Our customer service
We always do our best to be available when you need us. In situations like this, we sometimes receive so many questions in a short period that we can’t respond as quickly as usual, but we continue to be available through all our usual support channels.
What happens next?
Security is always our top priority. You should be able to trust that your website, email, and data are well protected, so you can focus on your business.
That’s why we continuously keep our systems up to date and take immediate action when needed.
Thank you for your trust and patience.