Shared and reseller hosting - all servers are patched, and file uploads and forms work normally again.
Managed and dedicated servers on our automatic updates - around four in five are patched, with their restrictions removed. The rest follow as the remaining patched versions arrive.
Servers not yet patched: the protections stay in place until they are, so those sites remain safe in the meantime.
A small number of servers run older versions of PHP that can’t be fixed on their current setup. We’ll contact those customers directly as soon as possible to talk through the options.
The last day and a half has been one of the most serious security events the web hosting world has faced in years. A serious vulnerability in PHP, the software behind most of the world’s websites, was made public with almost no warning and attacks began before a fix even existed.
Throughout, our priority has been keeping your websites and your customers’ data safe. That meant putting protections in place quickly, even though we knew they would cause some inconvenience. We know how disruptive that was, especially for online shops, and we are grateful for your patience while we worked through it.
Our team has been working around the clock alongside our software vendors, including CloudLinux, who have been releasing patched versions of PHP as fast as they could. Our automation has been installing each one the moment it arrived. As soon as every PHP version on a server is patched, it lifts that server’s restrictions so sites work normally again.
Thank you for bearing with us. It has been a demanding couple of days, and we’re glad to see sites back to normal.
If you’re not sure where your server stands, get in touch and we’ll tell you.
A critical security flaw in PHP, the software behind most websites, is being actively attacked. To keep your website and your customers safe until patched PHP is available, we have temporarily blocked the type of request the attack uses.
This means file uploads and some forms on your site will not work for now. How much this affects your site depends on the software it uses. Online shops may find that some customers cannot add to their basket, check out or log in to their account, and that admin tasks such as uploading product images, importing stock or printing labels fail.
We know this is disruptive. It is temporary, and we will lift it on each server as soon as that server is patched.
On Tuesday 20 October the PHP project gave advance notice of two critical security flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10).
PHP runs around three quarters of the world’s websites, including WordPress, WooCommerce, Magento, OpenCart, Joomla and Drupal.
Details leaked early, and attacks on PHP sites were reported from 08:43 BST on Wednesday 21 October, before the fix had been published. PHP released its fix at about 14:35 BST, together with full technical write-ups and a public attack tool. Researchers have shown that the flaws let an attacker take over a website without logging in.
The flaw is in PHP itself, so a site is exposed however well its own code is written, and its logins and admin checks do not protect it.
There was less than a day between the first warning and the first attacks, and mass scanning of websites was expected within minutes of the fix being published.
PHP publishes its fix as source code, for its newest versions only. Every version of PHP on our servers, the newest included, is built and supplied by our server vendors such as CloudLinux. Their builds are made to work with the security and isolation features that keep each account on a server separate and stable, and they also cover the older PHP versions you can choose in your control panel, which PHP itself no longer fixes. So even if your site runs the latest PHP, the fix reaches it through the vendor’s patched build. Those builds were not available when the attacks began, and we install them as soon as each one is released.
Until then, the only thing that reliably stops the attack is to stop it reaching PHP at all. Leaving sites open would have put every website on our servers, and the data of everyone who uses them, at risk of being taken over.
We appreciate that this action is disruptive, and hope you will understand that this interruption represents a far smaller harm, and hosts and security companies around the world are taking similar steps today. Some organisations have taken their websites offline altogether, as the BBC reports:
Websites taken down worldwide as critical PHP cyber-security update issued (BBC News, 21 October 2026).
Anything that sends a file, and some forms, will show an error page. For example:
These still work as normal in most cases: browsing your website, most logins and ordinary forms, email, and cPanel access. You can still upload files to your website with File Manager or SFTP.
Nothing. The restrictions are on our servers and cannot be switched off from your website, which is what keeps them effective. We are not able to make exceptions for individual pages or addresses while servers are unpatched, because any opening would leave that site exposed to the attack.
As each vendor releases patched PHP, we install it, check it, and remove the restrictions from that server. We will update this page as that happens.
Thank you for your patience while we keep your website and your customers safe.