What has happened?
A PHP security update has been released to address recently disclosed critical vulnerabilities. Updates have been applied to shared and managed hosting services, with mitigations used where patches could not be applied.
Have PHP versions above 7.4 been patched?
PHP versions above 7.4 on our shared and managed hosting services have been patched. This does not apply to unmanaged servers: customers managing their own servers must apply the relevant updates themselves.
I have an unmanaged server. What should I do?
Apply the relevant PHP security updates immediately. You or your server administrator are responsible for patching an unmanaged server. Do not assume that updates applied to shared and managed services have also been applied to your server.
My website uses a PHP version below 7.4. What should I do?
Upgrade PHP as soon as possible. Update your website code or application as needed to support PHP 8.2 or above, and check compatibility before changing the live PHP version. If you manage your own server, apply any available security updates immediately rather than waiting for the upgrade.
What if I use PHP 7.4 or another version below 8.2?
Plan to upgrade your website or application to support PHP 8.2 or above as soon as possible. We have applied updates to our Linux based Shared Hosting for PHP versions 7.4 and above. Alternative versions of versions 5.2 and above named alt-php also have patches. We do however advise that you look to update you application to use 8.2 or above as soon as you are able. Windows based services have patches applied to 8.2 and above, versions below this will not receive updates.
Will any further security updates be applied?
Update channels continue to be monitored for shared and managed services, and further patches or backported fixes will be applied where available. Customers with unmanaged servers must continue monitoring and applying relevant updates themselves.
