Simply Hosting & Servers incident
PHP security vulnerabilities – customer update
Resolved after 2 hours 25 minutes, on October 22, 2026.
On 20 October 2026, the Global PHP Security Team announced two critical security vulnerabilities. The official security updates were released the following day. Since millions of websites worldwide rely on PHP, the announcement understandably caused concern, and we received a large number of questions from our customers. Rightly so: the security of your website is extremely important. The good news? We took immediate action. Teams have been working non-stop to address the issue, taking mitigating measures where possible while waiting for the official software patches, and rolling out those patches as soon as they became available. All systems that could have been impacted on our hosting & company platforms have now been patched. Not every website runs on the latest PHP version. Some still use older versions, for example because certain plugins or applications are incompatible with a newer PHP release. Our teams went the extra mile and also adapted the security fixes for some older PHP versions. This process is called backporting: adapting a security patch so it also works with an older software version. It’s not simply a matter of copying a file. Our engineers have to manually implement, compile and test the necessary changes. The PHP project currently officially supports versions 8.2 through 8.5. Older versions no longer receive regular security updates. It goes without saying though, if you are on an older version of PHP, please update this.
Update timeline
- monitoring Oct 22, 2026, 01:16 PM UTC
On October 20, two critical PHP vulnerabilities were announced: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have a CVSS score of 9.2 and could potentially be exploited to execute code remotely on a server without requiring authentication. The vulnerabilities may affect all PHP versions starting from PHP 5. If you use PHP on your Bare Metal, Dedicated Server, VPS, we strongly recommend updating PHP with the patches that are available. If you are running cPanel/Plesk, patches are also available, and you should apply them. If you have a site/s running on these products from us, we recommend that you review your PHP usage and the version being used by you or your customers and take relevant actions. If you have managed server/vps with us, then these are/have been patched by our teams.
- monitoring Oct 22, 2026, 03:31 PM UTC
On 20 October 2026, the Global PHP Security Team announced two critical security vulnerabilities. The official security updates were released the following day. Since millions of websites worldwide rely on PHP, the announcement understandably caused concern, and we received a large number of questions from our customers. Rightly so: the security of your website is extremely important. The good news? We took immediate action. Teams have been working non-stop to address the issue, taking mitigating measures where possible while waiting for the official software patches, and rolling out those patches as soon as they became available. All systems that could have been impacted on our hosting & company platforms have now been patched. Not every website runs on the latest PHP version. Some still use older versions, for example because certain plugins or applications are incompatible with a newer PHP release. Our teams went the extra mile and also adapted the security fixes for some older PHP versions. This process is called backporting: adapting a security patch so it also works with an older software version. It’s not simply a matter of copying a file. Our engineers have to manually implement, compile and test the necessary changes. The PHP project currently officially supports versions 8.2 through 8.5. Older versions no longer receive regular security updates. It goes without saying though, if you are on an older version of PHP, please update this.
Your product runs on more than Simply Hosting & Servers
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services