On October 21, 2026, the PHP team disclosed two critical vulnerabilities in the PHP core (CVSS score 9.2). In theory, they could allow code to be executed on a server through a specially crafted HTTP request, without authentication. Fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Our shared hosting servers run CloudLinux, which provides and maintains the PHP versions available under Select PHP Version. As soon as the fix was published, CloudLinux released updated PHP packages, and we installed them on all servers the same day, restarting PHP processes so the patch took effect immediately.
This is the question we hear most often. CloudLinux builds security fixes into its own PHP packages (a so-called backport), so the version number shown in cPanel may not match the official version number listed by the PHP team. This does not mean your website is unprotected — the patch is applied regardless of the displayed version number.
No. No action is required on your part, and there is no need to change your PHP version. As always, we recommend using a current, supported PHP version (8.2 or newer) and keeping WordPress, plugins and other scripts on your website up to date.
If you use a VPS, you maintain PHP on it yourself, so we recommend updating PHP to a patched version as soon as possible. If you need help, we are here for you.
If you have any further questions, please open a ticket or contact our support team.
Your SkyHosting Team
