Updated on 23 Oct 2026

On 21st October 2026, two critical vulnerabilities were disclosed in PHP core. They affect PHP installations worldwide, whichever hosting provider you use.

Here’s what they mean for you, and what you need to do (if anything).

Quick summary

Attackers can use these vulnerabilities to run their own code on affected websites and access customer data. What you need to do depends on how your PHP is managed:

  • On Web Hosting or Hosting for WordPress? You’re covered. There’s no action needed.
  • Managing PHP yourself on a VPS or Dedicated Server? You need to update immediately.

Who’s at risk? 

Any PHP installation that serves web requests is affected. That includes:

  • PHP-FPM
  • Apache with mod_php
  • php-cgi
  • FrankenPHP
  • LiteSpeed

We consider mod_php as carrying the highest risk. There’s already a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

If you use Fasthosts Web Hosting or Hosting for WordPress 

Good news – you don’t need to do anything. We’ve rolled out the official PHP security updates across all our shared hosting platforms, so your website is protected.

That includes PHP versions that are no longer officially supported. If you’re running one of those, Fasthosts PHP Extended Support has you covered.

If you use a VPS, dedicated server or manage PHP yourself

You must install the PHP security update immediately. Update PHP to one of the patched versions released by the PHP project on 21st October 2026:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Visit the official PHP security advisory at php.net for the latest patched versions and detailed update instructions specific to your operating system and environment. If you’re unsure how to update PHP or need assistance, contact our support team.

Beware of phishing emails

Fraudsters often use security issues like this one as cover for phishing. They send fake emails that look official to trick you into handing over your login details.

If you get an email about these PHP vulnerabilities:

  • Don’t click any links or open any attachments in it.
  • Don’t enter your login details on a page you reached from an email link.
  • To check your account, type our website address into your browser yourself and log in from there.

We’ll never ask for your password by email.

Q&A

What does the vulnerability mean for my website?

The vulnerability allows attackers to run their own code on affected websites and potentially access customer data. It affects PHP installations worldwide regardless of hosting provider. Taking action to update PHP immediately is essential to protect your website and your customers' information.

Do I need to do anything if I use Fasthosts Web Hosting or Hosting for WordPress?

No. Fasthosts is rolling out official PHP updates automatically across all shared hosting platforms. You don’t need to take any action. Your website is being protected by these automatic updates.

I use a VPS or Dedicated Server – where do I find the PHP update?

Visit php.net to download the latest patched version of your installed PHP release. Follow the official PHP documentation for your operating system to install the update. If you are unsure how to update PHP, contact our support team or your system administrator for assistance.

Need more help?

If you have questions about the PHP vulnerability or need help updating PHP on a self-managed server, you can get in touch with our support team 24/7.