Update: The recently disclosed PHP vulnerabilities affect hosting providers and websites across the industry, and we continue to monitor the situation closely and proactively address any new developments.
This includes a newly disclosed PHP vulnerability,** CVE-2026-115560**. It affects only websites using an uncommon PHP session configuration, and there are currently no reports of it being exploited. The protective measures we put in place earlier this week also cover this issue, and we will apply PHP’s official fix as soon as it is released.
No additional action is required for customers in our managed hosting environments at this time. As always, we encourage all customers to keep their websites up to date, including WordPress, themes, plugins and any other software, as one of the best ways to stay protected.
Security is our top priority, and we will continue to share updates here as the situation develops.
Our teams have made significant progress deploying patched PHP builds across our hosting infrastructure to address the critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Mitigations such as blocks on file uploads via PHP remain in place as an additional layer of protection while this work is finalized.
What this means for you Shared Linux hosting, shared Windows hosting, shared WordPress hosting, and email hosting
No action is needed. We are patching these servers on your behalf, and your website and email will continue to work normally.
VPS / Dedicated Servers
If your server’s PHP packages don’t match the patched versions listed in this announcement, you’ll need to update PHP on your server. Please follow the steps in the help article PHP security update as soon as possible to patch the servers.
cPanel (EasyApache 4) 8.5 - PHP 8.5.12 8.4 - PHP 8.4.27 8.3 - PHP 8.3.36 8.2 - PHP 8.2.35 8.1 - PHP 8.1.34-5 8.0 - PHP 8.0.30-12 7.4 - PHP 7.4.33-19
Plesk (Linux and Windows)
8.5 - PHP 8.5.12 8.4 - PHP 8.4.27 8.3 - PHP 8.3.36 8.2 - PHP 8.2.35
Plesk Panel: Plesk Obsidian 18.0.81 Update 4 / 18.0.80 Update 11
CloudLinux EasyApache 4 (CentOS 7 / CloudLinux 7
8.5 - ea-php85 8.5.11-2 8.4 - ea-php84 8.4.26-2 8.3 - ea-php83 8.3.35-2.el7.cloudlinux.2 8.2 - ea-php82 8.2.34-2.el7.cloudlinux.1 8.1 - ea-php81 8.1.34-4.el7.cloudlinux.1 8.0 - ea-php80 8.0.30-11.el7.cloudlinux.1 7.4 - ea-php74 7.4.33-18.el7.cloudlinux.13 7.3 - ea-php73 7.3.33-15.el7.cloudlinux.18 7.2 - ea-php72 7.2.34-12.el7.cloudlinux.18 7.1 - ea-php71 7.1.33-20.el7.cloudlinux.17 7.0 - ea-php70 7.0.33-29.el7.cloudlinux.17 5.6 - ea-php56 5.6.40-25.el7.cloudlinux.18 5.5 - ea-php55 5.5.38-64.el7.cloudlinux.10 5.4 - ea-php54 5.4.45-82.el7.cloudlinux.9 5.3 - ea-php53 5.3.29-29.el7.cloudlinux.69 5.2 - ea-php52 5.2.17-27.el7.cloudlinux.67
CloudLinux / TuxCare alt-php (ELS)
8.5 - alt-php85 8.5.11-5 8.4 - alt-php84 8.4.26-5 8.3 - alt-php83 8.3.35-6 8.2 - alt-php82 8.2.34-7 8.1 - alt-php81 8.1.34-39 8.0 - alt-php80 8.0.30-69 7.4 - alt-php74 7.4.33-81 7.3 - alt-php73 7.3.33-82 7.2 - alt-php72 7.2.34-97 7.1 - alt-php71 7.1.33-114 7.0 - alt-php70 7.0.33-148 5.6 - alt-php56 5.6.40-147 5.5 - alt-php55 5.5.38-183 5.4 - alt-php54 5.4.45-203 5.3 - alt-php53 5.3.29-220 5.2 - alt-php52 5.2.17-242
If you need assistance or have any concerns, please contact our Support team.