We’ll add new information here as it happens, newest first. If you’re coming back to this page, this is the bit to check.
Time | Update |
|---|---|
18:33 | The vast majority of sites have now been patched. For a handful that it is not possible to update at this time, further communication and options will follow. |
16:31 | At this point, we are working through simple switching updates and waiting for compiled binaries from upstream vendors. |
14:34 | All sites prepared and waiting to begin updates from 15:00. |
11:50 | Correction – patches are scheduled for release at 14:00 UTC, which is 15:00 BST. |
11:28 | Interim protections rolled out across all sites to the extent possible with available information. |
09:05 | This post published. Patching for all tiers is scheduled to start at 14:00 today.
|
07:30 | Affected PHP features are disabled on Tier 1 (shared) hosting as a precaution. |
07:15 | We became aware of the security issues affecting PHP and began to understand the implications. |
What's happened
Two serious security flaws have been found in PHP, the software that powers a huge share of the world’s websites, including WordPress, WooCommerce and many of the sites we look after.
They’re known by their reference numbers, CVE-2026-109618 and CVE-2026-109619, and the PHP security team has rated both 9.2 out of 10 for severity.
In plain terms, researchers report that the flaws could let an attacker run their own code on a web server that hasn’t been updated. That’s why the fix needs to happen at server level, which is one of the things we deal with.
The full technical details are still under wraps. News of the flaws only became public on 20 October, and PHP is releasing its official fix today, 21 October. Keeping details back until a fix is ready is normal good practice, as it gives hosting providers a head start before anyone with bad intentions learns how the flaws work.
This isn’t specific to Ethical Pixels or to your site. Hosts and developers all over the world will be working through the same issue today.
Why there seem to be so many security alerts lately
If it feels like security warnings are everywhere this year, you’re right. 2026 is a record year by a wide margin.
Every publicly known security flaw gets a CVE number, a bit like a case reference. Around 48,000 were published in the whole of 2025. This year passed that total in mid-August, with more than four months still to go. The global incident response body FIRST now expects around 66,000 by the end of the year.
One big contributor is AI. Security researchers and software makers are now using AI tools to comb through code and find weaknesses far faster than people could alone. This has created a lot of extra work and more than a few chaotic days like today for those of us who run web servers.
There is a potential upside though. These flaws were there all along and now they’re being found, disclosed responsibly and fixed. FIRST is clear that the surge reflects more and better research, not software getting worse. Every flaw that’s found and patched is one fewer that someone could quietly exploit.
What we're doing about it
We’ve written this page so our clients, partners and anyone else who relies on us knows exactly how we’re handling it. The short version: you don’t need to do anything. Keeping server-side software like PHP up to date is part of what we do.
Tier 1 (shared hosting)
The affected parts of PHP are already switched off as a precaution. We’ll then apply the official update across our shared servers.
Updates start at 14:00 today, and should be completed by the end of the day.
Tiers 2 and 3 (VPS hosting)
We’ll update PHP on your server, along with our any associated management systems that also run on PHP.
Updates start as soon as possible after 14:00 today.
On Tier 1, if the precautions or the update affect how your site looks or works, which we expect to be rare, we’ll contact you directly.
If you’ve opted out of our regular maintenance updates: you may be running an older version of PHP. We don’t know for sure which versions of PHP will receive a patch, so older versions may not receive one. In that case, moving to a newer version of PHP is the safest way forward, and we’ll be in touch to talk you through this, and any associated cost in upgrading your site components to be compatible.
A small favour to ask
This update should be straightforward. That said, any software released in a hurry can occasionally cause unexpected side effects, and a lot of people around the world are moving quickly today.
So we’d ask everyone to bear with us. If you notice anything on your site not behaving as it should, such as a page not loading, a form not sending or anything that just looks odd, please log a ticket through our support system. That’s the quickest way to reach the right person, and we’ll look into it as soon as we can.
We’ll keep the Latest updates section at the top of this page current as things progress, so it’s worth checking back later today.
Thanks for your patience, and for trusting us with your site.
