Month: October 2026

I presume I will be offline for a short period later today when the updated version (PHP 8.4.27 ) is available – This won’t affect the station.

I use DreamHost:
“Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date.”

Critical PHP vulnerabilities expose vast majority of websites to potential compromise
Government agencies urged organizations to take their sites offline until they could be fixed.

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP.

---

WordPress.org
Active Incident

Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.

Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.

These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.

Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.

If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:
Where immediate remediation is not feasible, organizations should consider taking the system offline until it can be fully mitigated.

---

PHP Security Vulnerability: Protections Are In Place


October 21, 2026 10:59PM PDT
MONITORING
We have successfully completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure. For our remaining environments, our Operations Team is currently staging packages and running final stability tests to ensure a smooth transition. The mitigations we deployed earlier remains enforced, keeping your sites secure while we complete this final phase. No action is required on your end. We will provide another update once the full rollout has concluded.

October 21, 2026 1:43PM PDT
MONITORING
We’re continuing to roll out PHP’s official fix across all servers and expect it to be complete soon. Sites on PHP 8.1 and older are protected by the mitigations we deployed early, before the details were public. Security fixes for these versions, provided under our PHP Extended Support program, are being built and are expected to roll out within the next day. No action is needed on your end. We’ll keep you posted and share another update as soon as the rollout is complete.

October 21, 2026 12:55PM PDT
MONITORING
We are continuing to roll out PHP updates across all servers and PHP versions. Our systems remain closely monitored as the final updates finish deploying, and we will share our next update once the deployment is complete.

October 21, 2026 9:04AM PDT
MONITORING
We are currently rolling out PHP’s upstream fix fleet-wide. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts. We will continue to monitor systems closely as the final upstream fixes finish deploying. The next update will be provided once the fleet-wide deployment is fully complete.

October 21, 2026 6:46AM PDT
MONITORING
Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date. Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available. We’ll share another update once the patched builds are available.