Last updated: 21 October 2026<\/strong> The PHP development team has announced two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity.<\/p>\n\n\n\n An emergency security release is scheduled for Wednesday 21 October 2026 at 3 PM UK time<\/strong>.<\/p>\n\n\n\n PHP is used by millions of websites, including those running WordPress, WooCommerce, Magento and other popular applications.<\/p>\n\n\n\n This is an industry-wide security issue affecting PHP itself, rather than an issue specific to our hosting services.<\/p>\n\n\n\n The vulnerabilities could potentially allow attackers to execute malicious code on affected systems, putting websites and their data at risk.<\/p>\n\n\n\n The full technical details, affected PHP versions and available fixes have not yet been officially published.<\/p>\n\n\n\n Due to the severity of the announcement, we recommend that website owners remain vigilant and prepare to apply any necessary updates as soon as they become available.<\/p>\n\n\n\n If your website uses PHP, it may be affected.<\/p>\n\n\n\n This includes websites built using WordPress, WooCommerce, Magento and many other PHP-based applications.<\/p>\n\n\n\n For WordPress websites, you can normally check your PHP version under:<\/p>\n\n\n\n WordPress Dashboard > Tools > Site Health > Info > Server<\/strong><\/p>\n\n\n\n Please note that using a recent PHP version does not necessarily mean your website is protected against these newly announced vulnerabilities.<\/p>\n\n\n\n The affected and fixed versions will be confirmed in the official security release.<\/p>\n\n\n\n Our Systems and Development teams are aware of the vulnerabilities and are preparing to apply the relevant security updates as soon as they become available.<\/p>\n\n\n\n The action required depends on which PHP version you’re using and whether your hosting environment is managed by us.<\/p>\n\n\n\n Security updates will be provided for PHP 8.2 and newer versions.<\/p>\n\n\n\n For customers using our shared hosting, reseller hosting, managed servers or Scout platform<\/strong>, we will install the appropriate PHP security updates as soon as they become available.<\/p>\n\n\n\n Customers managing their own servers or PHP installations will need to arrange for the relevant updates themselves.<\/p>\n\n\n\n Some of our hosting environments use CloudLinux’s alt-PHP technology, which provides additional security maintenance for older PHP versions.<\/p>\n\n\n\n We expect CloudLinux to release backported security fixes for affected PHP versions older than 8.2.<\/p>\n\n\n\n However, we do not yet know how long these additional fixes will take to become available after the official PHP security release.<\/p>\n\n\n\n We will continue monitoring CloudLinux’s announcements and apply the relevant updates to the hosting infrastructure we manage once they become available.<\/p>\n\n\n\n If your website is running a PHP version older than 8.2 and is not covered by CloudLinux’s security maintenance, we strongly recommend upgrading to a modern, supported PHP version as soon as possible<\/strong>.<\/p>\n\n\n\n We understand that older websites and applications may not always be compatible with newer PHP versions.<\/p>\n\n\n\n Before upgrading, we recommend checking application compatibility, taking a backup and testing your website afterwards.<\/p>\n\n\n\n We’re also reviewing and implementing additional precautions while waiting for the official security fixes.<\/p>\n\n\n\n As an interim measure, we’re rolling out a change across our Scout hosting platform to disable PHP’s session upload progress feature, which may help reduce exposure to the reported vulnerabilities.<\/p>\n\n\n\n Our Systems team is also reviewing appropriate mitigations for our other hosting environments.<\/p>\n\n\n\n For environments where an immediate PHP update isn’t possible, we’re exploring alternative measures that may help reduce the risk.<\/p>\n\n\n\n Please note:<\/strong> These precautions cannot be guaranteed to provide complete protection and are not a replacement for applying the appropriate security updates.<\/p>\n\n\n\n While we wait for the official security release, there are several steps you can take to help protect your website and prepare for the updates.<\/p>\n\n\n\n Make a note of which PHP version your website currently uses, particularly if you’re running older software.<\/p>\n\n\n\n If you manage multiple websites or servers, check each one.<\/p>\n\n\n\n Older PHP versions may require additional attention, particularly where they are no longer officially supported or covered by vendor security updates.<\/p>\n\n\n\n Ensure WordPress, plugins, themes and other applications are using supported, up-to-date versions.<\/p>\n\n\n\n Keeping your website software updated is an important part of maintaining security and reducing exposure to known vulnerabilities.<\/p>\n\n\n\n Please note:<\/strong> Updating WordPress, plugins or themes alone will not fix a vulnerability within PHP itself.<\/p>\n\n\n\n Based on information currently available, disabling PHP’s session upload progress feature may help reduce exposure to at least one of the reported vulnerabilities.<\/p>\n\n\n\n The relevant PHP setting is:<\/p>\n\n\n\n We have already taken steps to apply this precaution at server level across our Scout hosting platform, shared hosting and Managed server clients.<\/p>\n\n\n\n If you manage your own server or PHP installation, you may wish to consider disabling this setting while awaiting the official security release.<\/p>\n\n\n\n Depending on your hosting environment, the setting may be configurable through Before making changes, please be aware that:<\/p>\n\n\n\n Disabling session upload progress is a temporary precaution only. Applying the official PHP security updates remains essential.<\/strong><\/p>\n\n\n\n If you’re using one of our managed hosting platforms and are unsure whether you need to make any changes, please contact Support for guidance.<\/p>\n\n\n\n Make sure you have a recent, working backup of your website and database.<\/p>\n\n\n\n Before applying major PHP updates, it’s sensible to take a fresh backup or snapshot where possible, particularly if your website uses older software.<\/p>\n\n\n\n Having a working backup can help you recover if a compatibility issue occurs following an update.<\/p>\n\n\n\n Once the fixed PHP versions become available, the appropriate security updates should be applied as soon as possible.<\/p>\n\n\n\n If you’re using our shared hosting, reseller hosting, managed servers or Scout platform, we will handle the relevant server-level PHP security updates.<\/p>\n\n\n\n If you manage your own server or PHP installation, please ensure you have a plan to install the appropriate updates and test your applications afterwards.<\/p>\n\n\n\n Where automatic security updates are available and appropriate for your environment, make sure they’re configured correctly.<\/p>\n\n\n\n These are precautionary measures only. Applying the appropriate PHP security update remains essential.<\/strong><\/p>\n\n\n\n The PHP development team will publish the affected versions and available fixes.<\/p>\n\n\n\n Hosting providers and software vendors will then need to distribute the relevant updates for their platforms.<\/p>\n\n\n\n Our approach will depend on your hosting environment:<\/p>\n\n\n\n We’re also exploring alternative precautions for environments where an immediate upgrade isn’t possible, although we cannot guarantee that these will provide complete protection.<\/p>\n\n\n\n Please remember that server-level PHP updates and website application updates are separate responsibilities. Customers using unmanaged website services should continue maintaining their WordPress installations, plugins, themes and other applications.<\/p>\n\n\n\n We will update this article as further information becomes available.<\/p>\n\n\n\n We recommend following these official sources:<\/p>\n\n\n\n If you have concerns about your hosting service or need assistance understanding your PHP configuration, please contact our Support team.<\/p>\n","protected":false},"excerpt":{"rendered":" Important PHP Security Update: What Website Owners Need to Know Last updated: 21 October 2026Update: Please keep an eye on our status page for further updates: https:\/\/status.freethought.uk\/announcements The PHP development team has announced two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity. An emergency…<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":["post-1428","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/posts\/1428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/comments?post=1428"}],"version-history":[{"count":0,"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/posts\/1428\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/media?parent=1428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/categories?post=1428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freethought.uk\/help\/wp-json\/wp\/v2\/tags?post=1428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Update: Please keep an eye on our status page for further updates: https:\/\/status.freethought.uk\/announcements<\/a><\/p>\n\n\n\nWhat is the risk?<\/h2>\n\n\n\n
Is my website affected?<\/h2>\n\n\n\n
What are we doing?<\/h2>\n\n\n\n
PHP 8.2 and newer<\/h3>\n\n\n\n
Older PHP versions using CloudLinux<\/h3>\n\n\n\n
Older PHP versions without CloudLinux protection<\/h3>\n\n\n\n
Temporary security precautions<\/h3>\n\n\n\n
What should I do now?<\/h2>\n\n\n\n
1. Check your PHP version<\/h3>\n\n\n\n
2. Keep your website software updated<\/h3>\n\n\n\n
3. Review PHP session upload progress<\/h3>\n\n\n\n
session.upload_progress.enabled = 0<\/code><\/p>\n\n\n\nphp.ini<\/code>, .user.ini<\/code> or your hosting control panel.<\/p>\n\n\n\n\n
4. Check your backups<\/h3>\n\n\n\n
5. Prepare for the official PHP update<\/h3>\n\n\n\n
What happens when the security update is released?<\/h2>\n\n\n\n
\n
Where can I find further information?<\/h2>\n\n\n\n
\n