All PHP versions on DomainsFoundry hosting servers are patched and secure.
At 14:00 UTC, 21 October 2026, the PHP project disclosed two critical security vulnerabilities. Before the announcement, the DomainsFoundry Security Team put custom WAF rules in place to protect our email and website hosting customers, and we’ve since rolled out the fixed PHP versions across our servers. Unless we’ve contacted you directly, there’s nothing you need to do.
We rarely talk about our security work publicly, as the detail can give attackers useful information. In this case, though, the vulnerabilities are already public and affect a large share of the web, so we want you to know they’ve been dealt with.
What happened
PHP is the programming language behind WordPress and a huge share of the web. The PHP team has released updates for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated critical. You can read the full details in the official PHP release notice.
What we’ve done
Firewall protection
At 09:00 UTC, 21 October 2026 we added new rules to our Web Application Firewall (WAF) that blocks attempts to exploit these vulnerabilities. They cover WordPress Hosting, Shared Hosting and Managed VPS.
Updated PHP versions
A firewall is an extra layer of protection, not a replacement for updating PHP itself. So we’ve also rolled out the fixed versions for PHP 8.5, 8.4, 8.3 and 8.2. Older versions (PHP 8.1, 8.0, 7.4 and below) have been updated with back-ported security patches.
Why does my PHP version still show an older number?
Your PHP version number may not have changed because the security fixes were back-ported into all PHP versions by CloudLinux, the provider of the software our hosting servers run on. This lets the vulnerabilities be fixed without changing the version number displayed.
Rest assured, you are on a fixed version of PHP that isn’t vulnerable to the reported exploits.
What you need to do
Nothing. If your website is hosted with DomainsFoundry on our Website Builder, WordPress Hosting, Shared Hosting or Managed VPS, we’ve handled the security update for you. The existing version of PHP currently selected on your DomainsFoundry hosting server is patched and secure. You should not need to change PHP versions, or take your site offline due to this PHP event.
The only exception is if you run PHP on a server hosted outside DomainsFoundry. That is to say your website is not hosted with DomainsFoundry. In that case, we recommending updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as you can, and check with your provider if you use an older version. If your provider can’t update and you’d like to move to one of our secure servers, place an order and we’ll help you migrate.
Questions?
Our support team is here to help. Contact support or check our status page for the latest updates.
