We want to let you know about a serious security issue that became public this week in PHP, the software that runs most websites — including WordPress sites and our own client area. We are aware of it, we have acted on it, and we want to explain in plain language what it means for you.
What happened
On 20 October 2026, details of two serious security flaws in PHP were leaked online before the official fixes were ready. In simple terms, the flaws could let an attacker take control of a website without needing a username or password. Because the details became public early, attack attempts started almost immediately. The PHP project released official fixes on 21 October 2026.
What Hostify has done
- We picked up the first reports as they appeared and began checking our servers straight away.
- We put our own protections in place as soon as the first reports appeared, and installed the official PHP patches across the servers we manage as soon as they were released on 21 October.
- We are monitoring our servers and customer websites closely for any unusual activity.
- We have no indication at this stage that any Hostify customer website has been affected.
What you need to do
If your website is on a Hostify shared, reseller or managed WordPress plan, there is nothing you need to do — we have handled it for you.
If you manage your own server (VPS or dedicated) or run a self-managed website, please make sure PHP is updated to the latest version for your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If you are still on PHP 8.1 or older, those versions no longer receive security fixes and should be upgraded as soon as possible.
If you are not sure which version your site is using, or you would like us to check for you, simply reply to this notice or open a support ticket and we will help.
Our commitment
Security issues like this are treated as a priority. We will keep watching for further developments and will post an update if anything changes. Thank you for your trust.