Urgent PHP security update: temporary restrictions on uploads and some forms

Update timeline

1. identified Oct 21, 2026, 04:22 PM UTC

   In short A critical security flaw in PHP, the software behind most websites, is being actively attacked. To keep your website and your customers safe until patched PHP is available, we have temporarily blocked the type of request the attack uses. This means file uploads and some forms on your site will not work for now. How much this affects your site depends on the software it uses. Online shops may find that some customers cannot add to their basket, check out or log in to their account, and that admin tasks such as uploading product images, importing stock or printing labels fail. We know this is disruptive. It is temporary, and we will lift it on each server as soon as that server is patched. What happened On Tuesday 20 October the PHP project gave advance notice of two critical security flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). PHP runs around three quarters of the world’s websites, including WordPress, WooCommerce, Magento, OpenCart, Joomla and Drupal. Details leaked early, and attacks on PHP sites were reported from 08:43 BST on Wednesday 21 October, before the fix had been published. PHP released its fix at about 14:35 BST, together with full technical write-ups and a public attack tool. Researchers have shown that the flaws let an attacker take over a website without logging in. The flaw is in PHP itself, so a site is exposed however well its own code is written, and its logins and admin checks do not protect it. Why we had to act with so little notice There was less than a day between the first warning and the first attacks, and mass scanning of websites was expected within minutes of the fix being published. PHP publishes its fix as source code, for its newest versions only. Every version of PHP on our servers, the newest included, is built and supplied by our server vendors such as CloudLinux. Their builds are made to work with the security and isolation features that keep each account on a server separate and stable, and they also cover the older PHP versions you can choose in your control panel, which PHP itself no longer fixes. So even if your site runs the latest PHP, the fix reaches it through the vendor’s patched build. Those builds were not available when the attacks began, and we install them as soon as each one is released. Until then, the only thing that reliably stops the attack is to stop it reaching PHP at all. Leaving sites open would have put every website on our servers, and the data of everyone who uses them, at risk of being taken over. We appreciate that this action is disruptive, and hope you will understand that this interruption represents a far smaller harm, and hosts and security companies around the world are taking similar steps today. Some organisations have taken their websites offline altogether, as the BBC reports: Websites taken down worldwide as critical PHP cyber-security update issued (BBC News, 21 October 2026). What we have done Blocked “multipart” form submissions on our servers. This is the format browsers use to send files, and some websites use it for ordinary forms as well. Every known attack arrives this way. These requests now get an error page (415, or 403 earlier this afternoon). Turned off a PHP feature the attack relies on. This has almost no visible effect. Switched on automatic patching across our entire server fleet. Our automation checks every one of our servers for patched PHP every 30 minutes, installs it the moment each vendor releases it, and reloads PHP so the fix takes effect straight away, with no waiting for a maintenance window. What will not work for now Anything that sends a file, and some forms, will show an error page. For example: uploading images or files in your website’s admin (the WordPress media library, product images, importers, theme and plugin uploads); contact or enquiry forms with an attachment, and some forms without one; on some shops, the basket, checkout or account pages, depending on the shop software and theme; admin tools that send files or forms in the background, such as label printing, importers or chat tools; some page builders and form plugins. These still work as normal in most cases: browsing your website, most logins and ordinary forms, email, and cPanel access. You can still upload files to your website with File Manager or SFTP. What you need to do Nothing. The restrictions are on our servers and cannot be switched off from your website, which is what keeps them effective. We are not able to make exceptions for individual pages or addresses while servers are unpatched, because any opening would leave that site exposed to the attack. When it ends As each vendor releases patched PHP, we install it, check it, and remove the restrictions from that server. We will update this page as that happens. Thank you for your patience while we keep your website and your customers safe.

2. monitoring Oct 22, 2026, 12:54 AM UTC

   Where things stand now Shared and reseller hosting - all servers are patched, and file uploads and forms work normally again. Managed and dedicated servers on our automatic updates - around four in five are patched, with their restrictions removed. The rest follow as the remaining patched versions arrive. Servers not yet patched: the protections stay in place until they are, so those sites remain safe in the meantime. A small number of servers run older versions of PHP that can’t be fixed on their current setup. We’ll contact those customers directly as soon as possible to talk through the options. The last day and a half has been one of the most serious security events the web hosting world has faced in years. A serious vulnerability in PHP, the software behind most of the world’s websites, was made public with almost no warning and attacks began before a fix even existed. Throughout, our priority has been keeping your websites and your customers’ data safe. That meant putting protections in place quickly, even though we knew they would cause some inconvenience. We know how disruptive that was, especially for online shops, and we are grateful for your patience while we worked through it. Our team has been working around the clock alongside our software vendors, including CloudLinux, who have been releasing patched versions of PHP as fast as they could. Our automation has been installing each one the moment it arrived. As soon as every PHP version on a server is patched, it lifts that server’s restrictions so sites work normally again. Thank you for bearing with us. It has been a demanding couple of days, and we’re glad to see sites back to normal. If you’re not sure where your server stands, get in touch and we’ll tell you.

3. monitoring Oct 22, 2026, 08:47 PM UTC

   Where things stand now Patching is complete across our fleet. PHP has been updated on every server we manage, and as each server was confirmed patched, our automation removed the temporary restrictions on file uploads and forms. Uploads and forms should now work normally everywhere. A small number of servers run older versions of PHP that can’t be fixed on their current setup. Their protections stay in place, and we are contacting those customers directly. How to check that your services are patched You can see this for yourself in your client area. Sign in, open your service, and look for the “PHP2Shell security fix” box. It also appears on your client area home page and on the open ticket page. It says whether PHP is patched on each of your services, and “Patched builds” shows the build installed on each PHP version. If your site or a security scanner reports PHP 8.3.35 rather than 8.3.36, that is normal on CloudLinux. The fix is added without changing the version number, so the server is patched. You do not need to move to a newer PHP version because of this. If you manage your own server, we don’t apply updates there and it won’t be listed in your client area, so please update PHP yourself. Open a ticket if you’d like our help. If something looks wrong If an upload or form still fails, or a service doesn’t show as patched when you expect it to, open a ticket with the address that fails and we’ll check it for you. Thank you for your patience as we’ve worked through keeping your sites safe.