On the 21st of October, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service which handles website traffic.
The UK’s National Cyber Security Centre (NCSC) has urged that all PHP fixes are applied immediately, and if this is not feasible the affected system should be taken offline until it is fully mitigated.
These updates were released for the supported versions of PHP, 8.2, 8.3, 8.4 and 8.5.
Once the updated versions of PHP were released, we ensured that all our servers and vendor applications were updated immediately.
We also took the decision to update all the websites running on our hosting servers and fixed any issues we found to ensure they remained running using a patched version of supported PHP.
No action is required on your part. Our team has applied the latest secure PHP patch to your website.
We have also removed the option from our cPanel’s to allow anyone to use an unsupported version of PHP, it is now only possible to run websites on version 8.2 and higher.
We will continue to monitor vendor and server applications for any new releases and ensure these are installed as soon as possible.
Security is our top priority, and we are committed to keeping your sites safe and performant. If you have any questions regarding this or need any help, please contact us via email at: info@chiphosting.co.uk