PHP Updates

Update(Oct 23rd 20:55est): The recently disclosed PHP vulnerabilities affect hosting providers and websites across the industry, and we continue to monitor the situation closely and proactively address any new developments.

This includes a newly disclosed PHP vulnerability, CVE-2026-115560. It affects only websites using an uncommon PHP session configuration, and there are currently no reports of it being exploited. The protective measures we put in place earlier this week also cover this issue, and we will apply PHP’s official fix as soon as it is released.

No additional action is required for customers in our managed hosting environments at this time. As always, we encourage all customers to keep their websites up to date, including WordPress, themes, plugins and any other software, as one of the best ways to stay protected.

Security is our top priority, and we will continue to share updates here as the situation develops.

Update (Oct 23rd 18:50est): Our teams have made significant progress deploying patched PHP builds across our hosting infrastructure to address the critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Mitigations such as blocks on file uploads via PHP remain in place as an additional layer of protection while this work is finalized.

What this means for you

Shared Linux hosting, shared Windows hosting, shared WordPress hosting, and email hosting No action is needed. We are patching these servers on your behalf, and your website and email will continue to work normally.

Self-managed VPS If your server’s PHP packages don’t match the patched versions listed in this announcement, you’ll need to update PHP on your server. Please follow the steps in the help article PHP security update as soon as possible to patch the servers.

For more information about the impact, please visit- https://www.networksolutions.com/help/article/php-security-update

If you need assistance or have any concerns, please contact our Support team. ​

cPanel (EasyApache 4)

Plesk (Linux and Windows)

CloudLinux EasyApache 4 (CentOS 7 / CloudLinux 7)

CloudLinux / TuxCare alt-php (ELS)

AlmaLinux

Rocky Linux

CentOS Stream

Fedora

Ubuntu

Debian

Update (Oct 23rd 09:35est): Our teams have successfully patched the majority of servers and are completing updates on the remaining systems. Mitigations such as blocks on file uploads via PHP remain in place as an additional layer of protection while this work is finalized. For more information about the impacts, please visit- https://www.networksolutions.com/help/article/php-security-update

If you need assistance or have any concerns, please contact our Support team.

Update(Oct 22nd 19:45est): Our teams have successfully patched the majority of servers and are completing updates on the remaining systems. Mitigations remain in place as an additional layer of protection while this work is finalized. For more information about the impacts, please visit- https://www.networksolutions.com/help/article/php-security-update

Update(Oct 22nd 11:30est): Our teams have successfully patched the majority of servers and are completing updates on the remaining systems. Mitigations remain in place as an additional layer of protection while this work is finalized. For more information about the impacts, please visit- https://www.networksolutions.com/help/article/php-security-update

Update(Oct 21st 23:00est): Our teams have successfully patched the majority of servers and are completing updates on the remaining systems. Mitigations remain in place as an additional layer of protection while this work is finalized.

Update(Oct 21st 12:18est): Our teams have made significant progress applying the latest PHP security patches across our servers. The majority of servers are now updated, and we’re continuing to roll out the remaining patches as quickly as possible.

As you may be aware PHP has reported an issue. To protect our customers, we are proactively taking steps to protect our customer base with various mitigations related to the PHP CVE. You should see no impact to the operation of your website or email but may see limits on the file size you can upload. Once patches have been confirmed released we will apply them as soon as possible.