{"incident":{"id":75,"title":"PHP Security Update","description":"The PHP project has announced a security release that is expected to be published on October 21. Full details will come out with the release. You can read the announcement here: https://www.php.net/archive/2026.php#2026-10-20-1\n\nOur team is monitoring the release and will deploy the update across our infrastructure as soon as it has been tested. No action is needed on your part.\n\nWe will update this incident further as more detail becomes available. If you have any questions in the meantime, open a ticket and we will be happy to help.","status":"informational","severity":"medium","created_at":"2026-10-20T23:01:12.097Z","updated_at":"2026-10-22T08:00:30.329Z","updates":[{"message":"Proactive protection against upcoming PHP security vulnerabilities\n\nThe PHP project has announced two critical security vulnerabilities affecting all supported PHP versions, with patches scheduled for release today at 9:00 AM Central (14:00 UTC). Details of the vulnerabilities have been circulating ahead of the patch, and we are seeing early attempts to probe for them.\n\nRather than wait for the patches, we have put protective measures in place across all servers. We have deployed a firewall rule that blocks requests matching the known attack pattern, and we have disabled a rarely used PHP feature (session upload progress tracking) that the attack is reported to rely on.\n\nThese measures should be invisible to the vast majority of sites. The one possible side effect is that a small number of plugins which display a progress bar during file uploads may no longer show progress; the uploads themselves will still complete normally. We decided this trade-off was worth it given the severity of the vulnerabilities.\n\nAs soon as the official PHP patches are released we will test and roll them out fleet-wide, and we will update this page when that is complete. No action is needed on your part.","timestamp":"2026-10-21T10:10:22.061Z","type":"update"},{"message":"**Update**\n\nCloudflare has released emergency managed WAF rules for these vulnerabilities, and we have enabled them alongside our own rule. We are actively monitoring blocked attempts across our network, recording the source addresses, and blocking those addresses at the network level on all servers. This means an attacker who is identified while probing sites behind Cloudflare is also cut off from any site that is not behind Cloudflare, and from any attempt to reach a server directly.\n\nWe are still on track to roll out the official PHP patches as soon as they are released, and will update here when that is complete.","timestamp":"2026-10-21T11:41:33.311Z","type":"update"},{"message":"Update\n\nThe PHP project has released the patched versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12). We are building the updated packages for our platform now and will begin rolling them out across all servers as soon as the builds complete and pass verification. Each server will see a brief restart of its PHP processes during the update, typically a second or two, with no action required on your part. We will update here when the rollout is complete.","timestamp":"2026-10-21T13:56:59.696Z","type":"update"},{"message":"Update\n\nThe patched packages have passed verification and the fleet-wide rollout is underway. In addition to the versions listed earlier, backported fixes for PHP 7.4 and 8.1 have also been released, so every PHP version we offer is being patched in this rollout.\n\nServers are being updated in batches, with a brief restart of PHP processes on each one as it completes. We expect the full rollout to finish within the next few hours. The protective firewall rules and network-level blocks described above remain in place throughout, so sites are covered whether or not their server has been reached yet.\n\nNo action is needed on your part. We will update here once the rollout is complete.","timestamp":"2026-10-21T17:07:00.000Z","type":"update"},{"message":"* PHP security update (CVE-2026-109618 / CVE-2026-109619) — Shared Hosting *\n\nWe’ve applied the patched PHP packages to our shared hosting servers. The following servers are fully patched and running the updated PHP:\n\nadamwest, bertram, birdperson, bonnie, bueller, carter, connie, darkhelmet, donna, goldman, herbert, lois, loretta, morty, opie, peter, pewterschmidt, rick, seamus, skroob, summer, tomtucker, unclebuck\n\nWe’re still working on brian, cleveland and stewie. These servers need additional work before they can be fully patched. A mitigation is already in place on them while we finish, and we’ll post another update here as soon as we have more to share.","timestamp":"2026-10-22T07:59:15.925Z","type":"update"},{"message":"*PHP security update (CVE-2026-109618 / CVE-2026-109619) — cPanel Managed VPS & Dedicated*\n\nAll cPanel Managed VPS and Dedicated servers have been updated with the patched PHP packages.\n\n- Servers running CloudLinux are fully patched for every installed PHP version, including older ones. CloudLinux released fixes for all of them.\n- Servers without CloudLinux are fully patched for PHP 7.4 and newer. cPanel did not release a fix for PHP 7.3 and older, so where those versions are installed, we’ve applied a mitigation that reduces the risk, but it is not a full fix.\n- A small number of servers on end-of-life operating systems can’t receive these fixes. They have the mitigation applied, and we’ll be in touch directly with the customers involved.\n\nOur recommendation: if any of your sites still run PHP 7.3 or older, please move them to PHP 8 (8.2 or newer where available). That gives you the full fix, and lets us remove the outdated PHP versions from your server entirely. Our team is happy to help with the switch.\n\nWe’ll post another update here soon.","timestamp":"2026-10-22T08:00:30.329Z","type":"update"}]}}