Update: 11:20am (23rd Oct) – CloudLinux has reported that all altPHP builds now have incremented version numbers. We have updated our servers, and they should now report the newer version number. More Details at https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

Update: 10:00am (23rd Oct) – Some of our customers are receiving incorrect reports that our servers are still running vulnerable versions of PHP. These reports are incorrect.

We run CloudLinux and the altphp packages they supply were patched without the version numbers being incremented. More details can be found here: https://cloudlinux.statuspage.io/

CloudLinux plans to release another update with incremented version numbers to help with the false reports. If you receive a report about the version of PHP your site is running on, please ignore it – Our servers are patched.

Update 10:00am (22nd Oct) – Patches have been installed and the servers brought online.

Update 8:30am (22nd Oct) – We are still waiting on some patches from our vendors and are keeping the server offline till they are delivered and tested.

Emergency downtime: approximately 2:00 am – 7:00 am (AEDT 22nd Oct)

We have temporarily taken our web servers offline as a precaution while we apply urgent security patches for two critical vulnerabilities in the PHP runtime.

What happened

On 21 October 2026, the PHP project released emergency security updates for two critical remote code execution vulnerabilities:

  • CVE-2026-109618 – RCE via out-of-memory (OOM) corruption
  • CVE-2026-109619 – RCE via stale global state

These are collectively referred to as PHP2Shell. Both are rated CVSS v4.0 9.2 (Critical).

Severity and impact

These are unauthenticated remote code execution flaws in the PHP engine itself. An attacker does not need a login or to target a specific application vulnerability. Under the right conditions, they can execute code with the privileges of the PHP worker process.

Who is affected:

  • All PHP installations
  • Versions from PHP 5.4 through 8.5.11

The PHP security team has stated that there are no complete mitigations — updating to a fixed version is the only safe solution. Details of the vulnerabilities leaked ahead of the official release, and security researchers expect rapid mass exploitation.

What we are doing

As a responsible hosting provider, we have taken the web server offline while we apply the patches across our infrastructure. This is a precautionary measure to protect your websites and data from potential exploitation. Email services will remain online during this time.

We expect the work to be complete by approximately 7:00 am AEDT. Sites will be brought back online as soon as the updates are verified.

What you need to do

Nothing. We are handling the patching on your behalf. Once the servers are back online, your sites will be running the updated PHP versions.

We apologise for the short-notice disruption. Given the critical severity and the public availability of exploit details, this was the safest course of action.

We will update this post if there are any changes to the expected restoration time.

Thank you for your understanding.