The PHP security team has announced an update to address two critical security vulnerabilities, scheduled for 21 October 2026 at 14:00 UTC. Details of the affected versions and relevant patches will be published when the update is released.
Shared hosting and managed customers: We will apply the relevant patches to your service once they are released and available for your hosting platform. You do not need to apply these patches yourself. Unmanaged server customers: You’ll need to update PHP on your server once the relevant security patches are available. We recommend applying these as soon as possible to help keep your server secure. We recommend that all customers use the latest supported PHP version compatible with their websites and applications, and keep it updated with the latest security patches. If you are running an unsupported PHP version, please arrange an upgrade to ensure you continue to receive security updates.