The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change.

Servers will still report the same PHP version (5.2–8.5) as before, but are running the fixed build. There's no need to change your PHP version or contact us to confirm your site is protected.

PHP updates have now been completed across our servers. All sites are now running the patched PHP Versions.

We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities.

We're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot continue to be protected or supported.

We are currently rolling out PHP's upstream fix. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts.

We will continue to monitor as the final upstream fixes finish deploying. The next update will be provided once the deployment is fully complete.

We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published.

Our PHP builds come from our vendors. In the meantime, we're putting additional protections in place to reduce the risk until the updates are rolled out.

Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed.

We'll update this notice as more information becomes available.