Important PHP security update

Resolved
Resolved

Our platform has now been successfully updated. This completes our deployment and all PHP versions across all platforms are now fully patched against the recently disclosed PHP vulnerabilities.

Avatar for
Updated

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are now available and the upstream security fixes have also been backported to all older PHP versions. The roll out to our hosting platform has completed.

Avatar for
Identified

We’re writing to make you aware that the PHP project has released security updates for two vulnerabilities it rates Critical: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities affect PHP core and PHP 5 and newer.

If you run PHP on an unmanaged VPS, please check your operating system or PHP vendor’s update channels for the relevant official security updates. We recommend installing them as soon as they are available for your operating system and installed PHP version.

Separately, our systems administration team is working to apply the updates across our virtualised platform, managed VPS and cloud servers. We will backport the necessary fixes across all PHP versions on those platforms, helping protect websites that use older PHP versions. We will update this page with further information.

Avatar for
Began at: