- Past notices
- No further notices from the past 7 days.
PHP Security Update — Shared Hosting
We are addressing the recently disclosed PHP vulnerabilities (CVEs). Please review the updates below, as some changes may affect your website.
PHP version support
Only PHP 8.2–8.5 are officially supported by the PHP project. Older versions have reached end of life and no longer receive official security updates.
If your website uses an older version, it may be exposed to security vulnerabilities unless your hosting platform provides extended security patches. While vendor patches can provide ongoing protection, we strongly recommend updating your website to support a current PHP version.
cPanel Hosting
cPanel has been updated on all servers. PHP support will be as follows:
Support for older PHP versions through our cPanel hosting platform is separate from official PHP project support.
As a temporary security measure, we have blocked HTTP POST requests on the cPanel shared hosting platform to help protect websites and servers while updates are pending. This may affect logins, contact forms, checkout pages and other features that submit information.
This restriction applies only to cPanel shared hosting. It does not apply to managed or unmanaged servers.
Windows shared hosting
PHP 8.4 will be the only supported PHP version on our Windows shared hosting platform. Websites that rely on older PHP versions and are incompatible with PHP 8.4 will stop working.
Affected customers have two options:
We strongly recommend moving PHP websites to cPanel hosting, as we are reviewing whether to continue supporting PHP on Windows shared hosting. No final decision has been made.
We understand these changes may cause disruption and appreciate your patience while we work to protect the hosting platform. Further updates will follow as patches become available.
We are issuing an advance security alert regarding two reported PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow remote code execution on affected systems.
The PHP security team has confirmed an upcoming release addressing two critical vulnerabilities rated 9.2 out of 10. The release is scheduled for Thursday, 22 October 2026 at 1:00 am AEDT (Sydney time), although it may be released earlier.
Full technical details, affected versions and fixed versions have not yet been published.
Action requested
If your website is running PHP 5.x, 7.x, 8.0 or 8.1, we strongly encourage you to log in to your hosting control panel and switch to a supported version, PHP 8.2–8.5, after checking compatibility with your website.
Please ensure your website software, plugins and themes are up to date, take a backup before making changes, and test your website after switching PHP versions. Contact our support team if you need assistance.
This alert is precautionary and does not indicate that your service has been compromised.
Official PHP announcement: https://www.php.net/archive/2026.php#2026-10-20-1
Kind regards, Support Team