Dear Customer,
At SIRSTEVEHQ, protecting your websites, applications, and hosting environment remains one of our highest priorities.
On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
These vulnerabilities could potentially allow unauthorised attackers to execute malicious code remotely on affected servers without requiring login credentials.
We want to reassure you that SIRSTEVEHQ has successfully deployed the relevant security patches across our managed hosting platforms.
What We've Done to Protect Your Websites
Our infrastructure team has completed the deployment of the PHP2Shell security patches across our hosting environments.
More importantly, the relevant security fixes have also been backported to all PHP versions available on our managed hosting platforms, including older PHP versions.
This means customers running older PHP versions on our patched hosting environments are also protected against these specific vulnerabilities, even where their PHP version number has not changed.
If your website is hosted on our managed shared hosting platforms, no action is required from you to install these server-level security patches. We have already taken care of that.
Official PHP Security Releases
The PHP development team released the following patched versions on October 21, 2026:
| PHP Branch | Patched Release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Please note that PHP 8.1 and earlier versions are no longer officially supported by the PHP development team.
Although SIRSTEVEHQ has applied backported security fixes to older PHP versions available on our managed platforms, we still recommend upgrading to a currently supported PHP version whenever your website or application is compatible.
Important Notice for Unmanaged VPS Customers
If you operate an Unmanaged VPS with SIRSTEVEHQ, please be aware that operating system maintenance, PHP updates, and server-level security patches remain your responsibility.
We strongly recommend that you:
- Check your server's installed PHP versions and available security updates.
- Review your operating system or PHP vendor's official update channels.
- Create a verified backup or server snapshot before applying updates.
- Install the relevant security patches as soon as possible.
- Verify that the updates have been successfully applied.
Depending on your operating system, control panel, or PHP vendor, security fixes may be distributed through official package repositories rather than direct PHP version upgrades.
Please do not delay these updates, as unpatched servers may remain vulnerable to remote attacks.
Keeping Your Website Secure
While these particular vulnerabilities have been addressed on our managed hosting platforms, we encourage all customers to continue following good security practices.
Keep your website applications, WordPress installations, themes, plugins, and frameworks updated. We also recommend maintaining regular backups and upgrading outdated software wherever possible.
Security is an ongoing responsibility, and our team remains committed to maintaining a secure and reliable hosting environment for your websites and applications.
For more technical information, you can review the official PHP security announcement:
View Official PHP Security Advisory
Need Assistance?
If you have questions about your hosting environment or need assistance reviewing your PHP configuration, please open a support ticket through your SIRSTEVEHQ Client Area.
Thank you for choosing SIRSTEVEHQ and trusting us with your online presence.
Stay secure,
The SIRSTEVEHQ Team
Powering Your Digital Presence.
