Update, 21 October 2026, 3:15pm: Fixed. The official PHP security update was released at 3pm today and is now installed across all InfaCloud servers. Our servers are running the fixed version of PHP, with no sites taken offline. You don’t need to do anything.
Today, 21 October 2026, you may have seen headlines about a serious security flaw in PHP, the programming language that runs most of the web. WordPress, Drupal, Joomla, WooCommerce and countless other platforms are built on it, which is why the news has caused so much concern. Some organisations, including government websites in the Netherlands, have taken their sites offline as a precaution.
If your website is hosted with InfaCloud, you don’t need to do anything. Here’s what happened, and what we’ve done to keep our clients safe.
What Is The PHP Vulnerability?
Two critical flaws were found in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”. The PHP security team has rated both as critical. In the wrong hands they could let an attacker run their own code on a web server, without needing a password.
Because the problem is in PHP rather than in any one plugin or theme, updating WordPress or your plugins doesn’t fix it. The only real fix is updating PHP on the server, and that’s a job for your hosting provider.
The UK’s National Cyber Security Centre and the EU’s CERT-EU have both told organisations to get ready to update straight away. Security firm Patchstack has reported attacks already under way.
What We’ve Done For Our Clients
As soon as the warning came out, we went through every website on every one of our servers. Here’s what we’ve done:
- Checked every site’s PHP version. The official fix is only being released for versions of PHP that are still supported. Older versions won’t get it.
- Moved sites on older PHP up to a supported version. Most of the websites that were on an older, unsupported version of PHP have now been moved up to PHP 8.3, so they’ll get the fix.
- Tested every site before and after. We checked each website loaded the same after the move. Where an old plugin wasn’t ready for the newer PHP, we put that site straight back and kept it running, so nobody’s website went down.
- Added extra protection on every server. Following guidance from Patchstack and the NCSC, we switched off the PHP feature the attacks are believed to use. It doesn’t affect how your website works, and it reduces the risk while the full fix rolls out.
- Installed the official fix as soon as it was released. The PHP team’s emergency update arrived at 3pm today, and it was running on every one of our servers within minutes, with no websites taken offline.
For the small number of websites running older plugins that need updating before they can move up, we’ll be in touch with those clients directly to get them sorted.
Why We Didn’t Take Websites Offline
Some agencies have taken all of their clients’ websites offline until the fix is out. That’s understandable if you can’t get to your servers quickly, but it means hours of lost enquiries and sales for the businesses involved.
Because we manage our own servers, we could act straight away: upgrading what needed upgrading, protecting what couldn’t be upgraded yet, and lining up the official update. Your website stays online and protected.
What This Means For You
If your website is hosted with InfaCloud, there’s nothing you need to do. We handle server security, PHP updates and backups behind the scenes, so you can get on with running your business.
If your website is hosted somewhere else, it’s worth asking your hosting provider three questions today:
- What version of PHP is my website running?
- When will you be installing today’s PHP security update?
- If my PHP version is too old to get the update, what’s the plan?
If you don’t get a clear answer, or you’re not sure who looks after your hosting, get in touch and we’ll happily check your website for you, free of charge.
We’ve Got Your Back
Security scares like this are a good reminder that hosting isn’t just about keeping a website online. It’s about having someone watching out for you when something goes wrong. That’s what our web hosting is built around: real people, looking after your website, acting fast when it matters.
