Urgent PHP vulnerabilities, servers being fixed
We’re going to roll out an urgent PHP update as soon as it’s available tonight.
Update (21/10/2026): To protect your sites from these critical PHP vulnerabilities we have disabled PHP's session.upload_progress.enabled setting across all managed cPanel servers and shared hosting environments. This setting is On by default, but for most most websites it's unlikely to make any practical difference to you or your customers.
The change should protect you from the attack, and we don't expect it to affect normal website functionality or file uploads. However, websites that specifically rely on PHP's built-in upload progress tracking may experience some impact. If you accept file uploads via any websites, that functionality could be affected.
If you notice any unexpected behaviour on your website following this change, please email [email protected] so we can investigate.
PHP has announced an urgent security update for two critical vulnerabilities that will be rolled out overnight tonight. Both vulnerabilities were given severity ratings of 9.2/10. They reportedly expose remote control execution vulnerabilities in PHP, which could potentially enable attackers to run their own code on a server and take control of it.
Their security team is aiming to release the fixes overnight at 3am New Zealand time.
As soon as the update is available, we’ll be updating the PHP minor versions on all our Web Hosting servers and managed servers with PHP versions receiving security updates.
Differences for managed and unmanaged servers
If you’re using managed Virtual Private Servers or Dedicated Servers, we’ll update your servers as soon as fixes are available.
If you’re using unmanaged Virtual Servers or Dedicated Servers, your PHP will not be automatically patched. We urge you to upgrade your PHP as soon as the fix is available. And if you’d rather not be responsible for rolling out patches in the wee small hours, consider adding Managed Services.
Another day, another vulnerability
Just earlier this week we reported a new critical Linux kernel vulnerability. Vulnerabilities are being discovered more quickly and more frequently than ever before, and they’re also being exploited much sooner.
If patching images at 3AM isn’t something you want to be doing manually, we totally understand. This overnight patching is a perfect demonstration of the value of Server Management.
If you’d like to talk with us about adding Management Services, we’re always ready to hear from you.