On 20 October 2026, details of two critical security vulnerabilities in PHP, the programming language that powers many websites including those we host, were made public. The issues are known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619). The PHP project released fixes on the afternoon of 21 October.
What we’ve done
Applied additional protective measures across our hosting platform while patches are rolled out
Begun installing the official security updates on all servers as they become available from our software providers
Increased monitoring of all servers and websites for any signs of attempted exploitation
Do you need to do anything?
No. We manage these updates for all websites on our hosting platform. You don’t need to take any action, and we don’t expect any disruption to your website.
Next update
We’ll update this page once patching is complete across all servers, or sooner if anything changes.
