A new PHP vulnerability is in the news. We tested it on our live servers: it can’t be used to take over sites hosted with us, WordPress included.
PHP has released a fix, and we’re applying it across all hosting today anyway. No action needed on your side.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially
