Important PHP Security Advisory (October 2026)
Important PHP Security Update: What Website Owners Need to Know
Last updated: 21 October 2026
Update: Please keep an eye on our status page for further updates: https://status.freethought.uk/announcements
The PHP development team has announced two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity.
An emergency security release is scheduled for Wednesday 21 October 2026 at 3 PM UK time.
PHP is used by millions of websites, including those running WordPress, WooCommerce, Magento and other popular applications.
This is an industry-wide security issue affecting PHP itself, rather than an issue specific to our hosting services.
What is the risk?
The vulnerabilities could potentially allow attackers to execute malicious code on affected systems, putting websites and their data at risk.
The full technical details, affected PHP versions and available fixes have not yet been officially published.
Due to the severity of the announcement, we recommend that website owners remain vigilant and prepare to apply any necessary updates as soon as they become available.
Is my website affected?
If your website uses PHP, it may be affected.
This includes websites built using WordPress, WooCommerce, Magento and many other PHP-based applications.
For WordPress websites, you can normally check your PHP version under:
WordPress Dashboard > Tools > Site Health > Info > Server
Please note that using a recent PHP version does not necessarily mean your website is protected against these newly announced vulnerabilities.
The affected and fixed versions will be confirmed in the official security release.
What are we doing?
Our Systems and Development teams are aware of the vulnerabilities and are preparing to apply the relevant security updates as soon as they become available.
The action required depends on which PHP version you’re using and whether your hosting environment is managed by us.
PHP 8.2 and newer
Security updates will be provided for PHP 8.2 and newer versions.
For customers using our shared hosting, reseller hosting, managed servers or Scout platform, we will install the appropriate PHP security updates as soon as they become available.
Customers managing their own servers or PHP installations will need to arrange for the relevant updates themselves.
Older PHP versions using CloudLinux
Some of our hosting environments use CloudLinux’s alt-PHP technology, which provides additional security maintenance for older PHP versions.
We expect CloudLinux to release backported security fixes for affected PHP versions older than 8.2.
However, we do not yet know how long these additional fixes will take to become available after the official PHP security release.
We will continue monitoring CloudLinux’s announcements and apply the relevant updates to the hosting infrastructure we manage once they become available.
Older PHP versions without CloudLinux protection
If your website is running a PHP version older than 8.2 and is not covered by CloudLinux’s security maintenance, we strongly recommend upgrading to a modern, supported PHP version as soon as possible.
We understand that older websites and applications may not always be compatible with newer PHP versions.
Before upgrading, we recommend checking application compatibility, taking a backup and testing your website afterwards.
Temporary security precautions
We’re also reviewing and implementing additional precautions while waiting for the official security fixes.
As an interim measure, we’re rolling out a change across our Scout hosting platform to disable PHP’s session upload progress feature, which may help reduce exposure to the reported vulnerabilities.
Our Systems team is also reviewing appropriate mitigations for our other hosting environments.
For environments where an immediate PHP update isn’t possible, we’re exploring alternative measures that may help reduce the risk.
Please note: These precautions cannot be guaranteed to provide complete protection and are not a replacement for applying the appropriate security updates.
What should I do now?
While we wait for the official security release, there are several steps you can take to help protect your website and prepare for the updates.
1. Check your PHP version
Make a note of which PHP version your website currently uses, particularly if you’re running older software.
If you manage multiple websites or servers, check each one.
Older PHP versions may require additional attention, particularly where they are no longer officially supported or covered by vendor security updates.
2. Keep your website software updated
Ensure WordPress, plugins, themes and other applications are using supported, up-to-date versions.
Keeping your website software updated is an important part of maintaining security and reducing exposure to known vulnerabilities.
Please note: Updating WordPress, plugins or themes alone will not fix a vulnerability within PHP itself.
3. Review PHP session upload progress
Based on information currently available, disabling PHP’s session upload progress feature may help reduce exposure to at least one of the reported vulnerabilities.
The relevant PHP setting is:
session.upload_progress.enabled = 0
We have already taken steps to apply this precaution at server level across our Scout hosting platform, shared hosting and Managed server clients.
If you manage your own server or PHP installation, you may wish to consider disabling this setting while awaiting the official security release.
Depending on your hosting environment, the setting may be configurable through php.ini, .user.ini or your hosting control panel.
Before making changes, please be aware that:
- Some applications use PHP’s built-in file upload progress tracking, which may stop working if this feature is disabled.
- You should test your website after making any changes.
- On managed hosting environments, this setting may be controlled at server level.
- This setting is not a confirmed or complete fix for the vulnerabilities.
Disabling session upload progress is a temporary precaution only. Applying the official PHP security updates remains essential.
If you’re using one of our managed hosting platforms and are unsure whether you need to make any changes, please contact Support for guidance.
4. Check your backups
Make sure you have a recent, working backup of your website and database.
Before applying major PHP updates, it’s sensible to take a fresh backup or snapshot where possible, particularly if your website uses older software.
Having a working backup can help you recover if a compatibility issue occurs following an update.
5. Prepare for the official PHP update
Once the fixed PHP versions become available, the appropriate security updates should be applied as soon as possible.
If you’re using our shared hosting, reseller hosting, managed servers or Scout platform, we will handle the relevant server-level PHP security updates.
If you manage your own server or PHP installation, please ensure you have a plan to install the appropriate updates and test your applications afterwards.
Where automatic security updates are available and appropriate for your environment, make sure they’re configured correctly.
These are precautionary measures only. Applying the appropriate PHP security update remains essential.
What happens when the security update is released?
The PHP development team will publish the affected versions and available fixes.
Hosting providers and software vendors will then need to distribute the relevant updates for their platforms.
Our approach will depend on your hosting environment:
- Shared hosting, reseller hosting, managed servers and Scout: We will apply the relevant PHP security updates to the infrastructure we manage as soon as suitable fixes become available.
- CloudLinux alt-PHP: We expect additional fixes for supported older PHP versions and will apply these as they become available. These may take longer than the official PHP releases.
- Customer-managed servers: Customers will need to review the official release and arrange for the appropriate updates themselves.
- Older PHP versions without security maintenance: We strongly recommend upgrading to a supported PHP version, as security fixes may not be available for your existing version.
We’re also exploring alternative precautions for environments where an immediate upgrade isn’t possible, although we cannot guarantee that these will provide complete protection.
Please remember that server-level PHP updates and website application updates are separate responsibilities. Customers using unmanaged website services should continue maintaining their WordPress installations, plugins, themes and other applications.
We will update this article as further information becomes available.
Where can I find further information?
We recommend following these official sources:
If you have concerns about your hosting service or need assistance understanding your PHP configuration, please contact our Support team.