PHP Security Update: Our Servers Are Patched
- Thursday, 22nd October, 2026
- 06:34am
You may have seen news reports this week about a serious security flaw in PHP, the programming language that powers most of the world's websites, including WordPress.
Our servers have already been updated. We installed the fixed version of PHP on Thursday 22 October, within a day of the fix being released, and checked that every website we host was working normally afterwards. Customers don't need to do anything.
What happened
On 21 October the PHP project released urgent security updates for two flaws, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), that could allow an attacker to run code on a web server. Because the problem was in PHP itself rather than in any individual website, it affected websites everywhere, and some organisations took their sites offline until they could update.
What we did
- Updated PHP on our hosting servers to the fixed release on 22 October.
- Checked every customer website afterwards to make sure it was working normally.
- Reviewed our server logs for signs of attempted attacks.
Keeping your site secure
This update protects the servers your website runs on. If your site uses WordPress or another system with plugins or themes, keeping those up to date remains the best way to protect it.
If you have any questions, please open a support ticket from your client area and we'll be happy to help.
