System Status

[UPDATE Oct 22, 2026 09:40 am(PST)] PHP Security Update for Legacy PHP Versions

For customers who still require legacy PHP versions (PHP 5.6, 7.4, 8.0, or 8.1), we would like to provide an important update.

While we continue to support modern PHP versions on our Windows hosting platform, maintaining security patches for end-of-life PHP releases on Windows has become increasingly difficult due to the limited availability of vendor-supported updates and binaries.

To ensure continued security and service availability, we have deployed patched and secured versions of PHP 5.6, 7.4, 8.0, and 8.1 on our Linux hosting platform. Customers who are unable to upgrade their applications to PHP 8.5 may choose to migrate to a Linux hosting plan, where these legacy PHP versions can continue to receive security maintenance.

Please note:

1. This recommendation is made for security and compatibility reasons.
2. We are not forcing customers to change plans, and there is no requirement to migrate if your website already supports a current PHP version.
3. Customers are strongly encouraged to upgrade to PHP 8.5 whenever possible, as it remains the best long-term solution.
4. For applications that cannot yet be upgraded, our Linux platform provides a safer environment for maintaining legacy PHP versions.

[UPDATE Oct 22, 2026 02:44 am(PST)] On October 21, 2026, the PHP development team published a critical security advisory for two vulnerabilities that allow unauthenticated remote code execution:

- CVE-2026-109618 — RCE via out-of-memory corruption
- CVE-2026-109619 — RCE via stale global state

Both are rated CVSS v4.0 9.2 (Critical). An unauthenticated request may be able to execute code on the server before any application code runs. PHP states that there is no complete mitigation — updating is the only safe option.
Official advisory: https://www.php.net/archive/2026.php#2026-10-21-5

What we have done

We have applied the official fixes across all supported PHP branches on our servers:

- PHP 8.2 -> 8.2.35
- PHP 8.3 -> 8.3.36
- PHP 8.4 -> 8.4.27
- PHP 8.5 -> 8.5.12

In addition, all customer websites on our platform have been force-mapped to PHP 8.5. This was applied at the server level, so every site is now running a patched PHP version by default and is protected against these vulnerabilities.

Important: we have not modified, suspended or disabled any customer website. Your files, databases and settings are untouched. The only change is which PHP version your site resolves to.

Change to our PHP support policy

PHP 8.1 and all older branches (8.0, 7.4, 7.3 and below) have reached end of life and will not receive an official fix for these vulnerabilities. Because no complete mitigation exists, we can no longer support PHP versions below 8.2. This restriction will remain in place until the PHP security issue is fully resolved.

If your application is not yet compatible with PHP 8.5

You can change the PHP version for your own site at any time:

1. Log in to your control panel and open the website settings for the affected domain.
2. Locate the PHP version selector and choose PHP 8.2, 8.3 or 8.4.
3. Save the change and test your website — front end, admin area, forms and database connections.

All three of these versions are already patched, so choosing any of them keeps your site protected. However, please continue upgrading to the latest PHP version available and keep your application, themes and plugins up to date.

Why we recommend moving to PHP 8.5 and staying current

- PHP 8.2 reaches end of life on December 31, 2026. After that date it will receive no further security fixes — including fixes for vulnerabilities of this severity.
- PHP 8.3 and 8.4 also have limited remaining support windows. PHP 8.5 is the current stable branch and gives you the longest support runway.
- An outdated PHP version is one of the most common causes of compromised hosting accounts. Staying on a supported branch is the single most effective protection.

If you use an older CMS, plugin or custom code that does not run correctly on a newer PHP version, please contact the application vendor for a compatible release rather than remaining on an unsupported version.

If you need help confirming which PHP version your site is using, or you run into problems after switching versions, please open a support ticket and our team will be glad to assist.

Thank you for your prompt attention to this important security matter.

Sincerely,
Support Team