Critical PHP vulnerability: already fixed on our servers

In October, two critical security flaws were found in PHP – the programming language most websites run on. If your website is hosted with us, there’s nothing for you to do: since 21 October, the update has been installed and active on all our web servers.

What was the problem?

WordPress, Joomla, many online shops and countless other websites run on PHP. Both flaws were in PHP itself, not in a particular system or plugin. That meant practically every PHP website was affected, whatever software it was built with.

With a specially crafted request to the website, an attacker could have run their own code on the server – without logging in and before the website’s software even starts. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated critical at 9.2 out of 10.

What we did

• 20 October: the PHP project announces an urgent security update.
• 21 October, 2:14 a.m. CEST: PHP releases the fixed versions – earlier than the announced 4 p.m., because details of the flaws had already leaked.
• The makers of our hosting software then rebuild and ship their packages.
• 21 October, 4:57 p.m. CEST: the update is installed and active on all our web servers – the same day the fix came out.

Do you need to do anything?

If your website is hosted with us: no. The update is already active.

If you run PHP elsewhere – on your own server or with another host – check that a fixed version is running there, or ask your provider:

• The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• PHP 8.1 and older no longer get fixes from the PHP project. If your website still runs on it, you should move to a current version.