PHP Security Vulnerability: Protections Are In Place

Update timeline

1. monitoring Oct 21, 2026, 01:46 PM UTC

   Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date. Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available. We'll share another update once the patched builds are available.

2. monitoring Oct 21, 2026, 04:04 PM UTC

   We are currently rolling out PHP's upstream fix fleet-wide. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts. We will continue to monitor systems closely as the final upstream fixes finish deploying. The next update will be provided once the fleet-wide deployment is fully complete.

3. monitoring Oct 21, 2026, 07:55 PM UTC

   We are continuing to roll out PHP updates across all servers and PHP versions. Our systems remain closely monitored as the final updates finish deploying, and we will share our next update once the deployment is complete.

4. monitoring Oct 21, 2026, 08:43 PM UTC

   We're continuing to roll out PHP's official fix across all servers and expect it to be complete soon. Sites on PHP 8.1 and older are protected by the mitigations we deployed early, before the details were public. Security fixes for these versions, provided under our PHP Extended Support program, are being built and are expected to roll out within the next day. No action is needed on your end. We'll keep you posted and share another update as soon as the rollout is complete.