Dear Customer,
Two critical security flaws (CVSS 9.2/10) have been found in PHP. An attacker could use them to run malicious code on your server without logging in, which could expose your website data.
Who is affected?
Any server running PHP, including websites or applications that use it.
What you should do:
- Check which PHP versions are installed on your server, including those used by each website or application.
- Install the latest security updates from your OS, PHP or control panel vendor.
- Confirm that your PHP services are running the updated, patched version.
- If no update is available yet, limit public access to the affected sites and plan an upgrade.
- Test your applications before changing PHP versions on live sites.
Notes:
- If your server doesn’t use PHP at all, you can ignore this notice.
- If PHP is installed but you think it isn’t being used, check that nothing depends on it before deciding no action is needed.
- Because your server is on an unmanaged plan, keeping the operating system and applications updated is your responsibility.
For details and fixed versions, see the official PHP announcement:
https://www.php.net/archive/2026.php#2026-10-21-5
Please treat this as a priority.
Thank you,
ActiveServers Support
Csütörtök, Október 22, 2026
