A critical security flaw in PHP, the software behind most websites, is being actively attacked. To keep your website and your customers safe until patched PHP is available, we have temporarily blocked the type of request the attack uses.
This means file uploads and some forms on your site will not work for now. How much this affects your site depends on the software it uses. Online shops may find that some customers cannot add to their basket, check out or log in to their account, and that admin tasks such as uploading product images, importing stock or printing labels fail.
We know this is disruptive. It is temporary, and we will lift it on each server as soon as that server is patched.
On Tuesday 20 October the PHP project gave advance notice of two critical security flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10).
PHP runs around three quarters of the world’s websites, including WordPress, WooCommerce, Magento, OpenCart, Joomla and Drupal.
Details leaked early, and attacks on PHP sites were reported from 08:43 BST on Wednesday 21 October, before the fix had been published. PHP released its fix at about 14:35 BST, together with full technical write-ups and a public attack tool. Researchers have shown that the flaws let an attacker take over a website without logging in.
The flaw is in PHP itself, so a site is exposed however well its own code is written, and its logins and admin checks do not protect it.
There was less than a day between the first warning and the first attacks, and mass scanning of websites was expected within minutes of the fix being published.
PHP publishes its fix as source code, for its newest versions only. Every version of PHP on our servers, the newest included, is built and supplied by our server vendors such as CloudLinux. Their builds are made to work with the security and isolation features that keep each account on a server separate and stable, and they also cover the older PHP versions you can choose in your control panel, which PHP itself no longer fixes. So even if your site runs the latest PHP, the fix reaches it through the vendor’s patched build. Those builds were not available when the attacks began, and we install them as soon as each one is released.
Until then, the only thing that reliably stops the attack is to stop it reaching PHP at all. Leaving sites open would have put every website on our servers, and the data of everyone who uses them, at risk of being taken over.
We appreciate that this action is disruptive, and hope you will understand that this interruption represents a far smaller harm, and hosts and security companies around the world are taking similar steps today. Some organisations have taken their websites offline altogether, as the BBC reports:
Websites taken down worldwide as critical PHP cyber-security update issued (BBC News, 21 October 2026).
Anything that sends a file, and some forms, will show an error page. For example:
These still work as normal in most cases: browsing your website, most logins and ordinary forms, email, and cPanel access. You can still upload files to your website with File Manager or SFTP.
Nothing. The restrictions are on our servers and cannot be switched off from your website, which is what keeps them effective. We are not able to make exceptions for individual pages or addresses while servers are unpatched, because any opening would leave that site exposed to the attack.
As each vendor releases patched PHP, we install it, check it, and remove the restrictions from that server. We will update this page as that happens.
Thank you for your patience while we keep your website and your customers safe.