Hello,
On 21 October 2026 the PHP project released an emergency security update for two critical vulnerabilities in PHP itself, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). These flaws let an attacker take over a website without logging in, and attacks were already happening, so we acted immediately.
What we did
- All of our web servers have been updated to PHP 8.4.27, which contains the fixes.
- Older PHP versions (5.x and 7.x) have been retired from our servers. They no longer receive security fixes and will not be patched for these vulnerabilities. Sites that were still using them have been moved to PHP 8.4.27.
Do you need to do anything?
- Most sites need no action. If your site is working normally, nothing has changed for you.
- If your site needed changes, or could not run on the updated PHP, we have already contacted you directly with the details and your options. Please check your inbox and your tickets.
- If you notice a problem we haven’t contacted you about, reply to this message or open a ticket, and include your site’s address.
Keeping your site up to date
Sites built on outdated software (old WordPress versions, themes, plugins or custom code) are the ones most often affected by changes like this, and the most often attacked. Please keep your site software up to date.
Thank you for your patience while we work to keep everyone’s sites safe.
Best regards,
ResellerChoice.com
Thursday, October 22, 2026
