On 20 October, the PHP developers announced an upcoming security release addressing two critical vulnerabilities. Both vulnerabilities have been rated 9.2 out of 10 under the CVSS 4.0 scoring system.
The release is scheduled for 21 October 2026 at 14:00 UTC. Full details of the vulnerabilities, affected PHP versions, and available fixes will be published by the developers when the security release becomes available.
We are closely monitoring the situation and awaiting the official security updates from the PHP development team.
In the meantime, temporary measures have been implemented across all PHP versions in use on our servers to mitigate the known vulnerability exploitation paths. In particular, the PHP session upload progress tracking feature, session.upload_progress, has been disabled.
No, websites will continue to operate normally. The measures implemented are not expected to affect website availability or the operation of their core functionality.
However, on some websites, the upload progress bar may no longer be displayed when uploading files. File uploads themselves will remain available.
As soon as the official PHP security updates are released, we will install them on the servers as soon as possible.
The updates will be carried out with website availability in mind and will not require any additional action from website owners.
We continue to monitor the situation and respond promptly to new security recommendations.
Thank you for being with us!
Source: Official PHP announcement regarding the upcoming security release.
Support Chat
Login