The PHP project has announced two critical security vulnerabilities in PHP itself. PHP is used by most websites, including WordPress, Joomla and many other applications, so this affects hosting providers worldwide.
Technical details have not yet been published, and there is currently no complete workaround. The only full fix is an updated version of PHP. PHP has scheduled fixed releases for 14:00 UTC today (21 October 2026).
What we have done:
- Applied the currently known mitigations across our shared hosting servers and the servers we manage for customers. These reduce risk but do not fully protect against the vulnerabilities, which is why patching remains essential.
- Put additional monitoring in place to help us identify suspicious activity.
- Started working with our upstream partners (the control panel and PHP vendors) so that patched versions can be tested and applied across all servers as soon as they are available to us.
- Applied some restrictions to our own websites based on the reported vulnerabilities
Timeline:
- Once the PHP project releases its fixes (at 14:00 UTC), our vendors need to package them for our platforms. We do not control that timing, but we will roll out patches as soon as they are available.
- Patches will be applied server-wide. You do not need to do anything to receive them, and we will update this page when they are applied.
- Some older PHP versions (8.1 and below) are not expected to receive an official fix.
- There may be some downtime caused from patching. PHP processes may restart briefly.
Recommendations:
- Use a supported PHP version (8.2 or newer) for your sites if you can. You can change this in your control panel.
- Keep your website software, plugins and themes up to date, and remove any you no longer use.
- If you would prefer to take your site offline until patches are applied, you can do this yourself, for example with a maintenance mode plugin. We are not able to take individual sites offline and bring them back on request, and you do not need to wait for us to contact you before restoring your site.
If you notice anything unusual, such as unfamiliar files, new admin users or unexpected redirects, please contact support.
We will keep this page updated throughout the process.
Many thanks
The MediaBlaze Hosts Team
