Shared servers (Fluccs), Shared servers (Exigent), VPS (Fluccs), VPS (Exigent)
October 22, 2026 1:38PM AEST
RESOLVED
Resolved: Critical PHP security vulnerabilities (PHP2Shell)
All vendor security updates that can be applied, have now been applied across our servers. All shared hosting and cPanel managed servers are fully patched against both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
We have two remaining managed servers unable to receive vendor patches at present. Both are still protected by a temporary fix we applied and we're contacting those customers directly about next steps and monitoring them closely.
If you run your own unmanaged server, please make sure you've updated PHP.
This incident is now resolved. If you have any questions, please open a support ticket and our team will be happy to help.
October 22, 2026 11:57AM AEST
IDENTIFIED
Critical PHP security vulnerabilities (PHP2Shell)
All shared hosting servers are fully patched against both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
All cPanel managed servers are also fully patched.
We are working through the remaining Managed Servers to apply vendor updates.
If you run your own unmanaged server, please make sure you’ve updated PHP. Or reach out to our support team if you have any questions or need assistance.
If your site uses PHP 7.2 to 8.1, we still strongly recommend upgrading to a newer version. We’ll contact affected customers over the coming days with more information.
October 22, 2026 7:57AM AEST
IDENTIFIED
**PHP security update — shared hosting patching complete**
We have completed the installation of vendor security updates across our cpanel shared hosting and reseller servers to address **CVE-2026-109618 and CVE-2026-109619**, following the emergency mitigations applied earlier.
Shared hosting customers do not need to install these server-level updates. We continue to recommend that customers using **PHP 8.1 or earlier** work with their website developer to move to a supported PHP version.
The team are continuing to work through our Windows Plesk Shared Hosting servers and Managed Server clients to apply the recently released vendor updates.
**Unmanaged server customers:** You or your appointed administrator remain responsible for checking and updating your server. Completion of our shared hosting updates does not apply to unmanaged services.
If you experience any issues with your hosting service, please open a support ticket.October 22, 2026 12:57AM AEST
IDENTIFIED
**PHP security update — 22 October 2026**
We have applied emergency mitigations to our share hosting and managed server environments while we await the corresponding vendor patches. Our team continues to monitor vendor releases and will apply security updates as they become available.
PHP has confirmed that **CVE-2026-109618 and CVE-2026-109619** can allow remote code execution without authentication. Fixes have been released in **PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12**.
Temporary mitigations reduce exposure but do not provide complete protection. Installing the security updates remains necessary.
**Shared hosting and managed server customers:** Our team manages server-level security updates. We strongly encourage customers using **PHP 8.1 or earlier** to move to a supported, patched version. Your website developer may need to update your website, plugins or themes to ensure compatibility before switching PHP versions. Please contact support if you need guidance.
**Unmanaged server customers:** You or your appointed administrator are responsible for assessing your server, applying the appropriate updates and completing any required service restarts. If you use older PHP versions through an extended-support vendor, please confirm that its packages include fixes for both vulnerabilities. Updating your website or CMS alone does not address these vulnerabilities.
We will provide a further update as patching progresses.
[Official PHP security advisory](https://www.php.net/archive/2026.php)October 21, 2026 4:02PM AEST
IDENTIFIED
The PHP security team has announced a security release addressing two critical vulnerabilities, each rated 9.2 out of 10. The release is scheduled for 1 am Thursday 22 October 2026, Sydney/Melbourne time, but may be published earlier.
Our team will review the advisory on release and apply relevant patches to our managed hosting environments. Any required maintenance or service interruptions will be communicated through this status page.
Affected PHP versions, technical details and fixed versions will be published with the release.
Official PHP announcement can be viewed here https://www.php.net/archive/2026.php#2026-10-20-1