23 Oct, 00:38 Our upstream datacentres have confirmed that critical security patches have been applied to our cPanel hosting platform for all versions of PHP from 5.2 to 8.5
Two critical security flaws in PHP, the software WordPress runs on, were announced on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, known as “php2shell”). They could let an attacker take control of a website without logging in, and security researchers have reported attempts to exploit them.
On a Watch the Dot care plan? No action needed. We’re checking every site we maintain and making sure it runs a fixed version of PHP.
Everyone else: please check your site today.
- Your site needs PHP 8.2 or newer. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; your hosting company installs these, so check with them if you’re not sure.
- If your site runs PHP 8.1 or older, switch it to PHP 8.3 or 8.4 as soon as possible. Older versions won’t be fixed.
- How to switch: Switch PHP version in cPanel, or in the eXtend control panel.
- Check your site afterwards. If anything looks wrong, or you’d rather we did it, open a ticket.