Security patches have now been released to address two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. We are applying the relevant patches across our shared hosting and managed services. Customers with unmanaged servers should apply the relevant security updates as soon as possible.
The UK’s National Cyber Security Centre (NCSC) is urging organisations to take immediate action. Under certain conditions, these vulnerabilities could allow an attacker to run commands on an affected server without logging in, potentially compromising the server and the websites or applications it hosts. The NCSC advises that organisations using PHP version 5 onwards are affected and should update to a fixed version. Running a recent PHP version does not, on its own, mean that a system is protected.
Shared hosting and managed customers
We are applying the relevant PHP security patches to your service. You do not need to install these server-side patches yourself. Please continue to keep your website software, plugins and themes up to date, as these remain separate from the PHP security updates.
Unmanaged server customers – urgent action required
You are responsible for updating PHP on your server. Please identify all PHP installations and apply the relevant security patches as soon as possible, prioritising systems accessible from the internet. Check for updates from your operating system, control panel and other software vendors, including products that bundle PHP. Updating your website software alone does not replace the need to patch PHP.
Ongoing protection and further information
Use a supported PHP version compatible with your websites and applications, and keep it updated with the latest security patches. If you are running an unsupported PHP version, arrange an upgrade to a fully supported version. Continue monitoring affected systems for suspicious activity and follow further security updates from PHP and relevant software vendors.