If you're using our managed services, you're already protected. Our team has acted quickly to fix a serious security issue in PHP, a language essential for many websites to function. We'll explain what happened, why it's important, and what you should do if you're using an older version of PHP.
What happened, explained simply
PHP is a programming language used by many websites to display dynamic content, like online stores or blogs. It's like the engine of a website: if it doesn't work properly, the site won't display correctly.
On October 21, 2026, the PHP team published an urgent update to fix two bugs (CVE-2026-109618 and CVE-2026-109619). These bugs allowed an attacker to run malicious code on the server without needing to be logged in. It's like someone being able to open your house door without a key and do whatever they want inside.
The severity of these bugs is very high (CVSS 9.2 out of 10), which means it's very important to fix them quickly. Our team has already applied the patch to all managed servers.
Why it's important
If a website doesn't have the patch applied, it could be affected by attacks. An attacker could, for example, install malware, steal data, or even take control of the website. This doesn't mean your website is in danger right now, but it does mean it's important to be prepared.
Thanks to the patch already being applied on managed servers, your website is protected. If you're using an older version of PHP, you might not receive the patch automatically, so it's important to check your configuration.
Does it affect you?
The affected versions are:
- PHP 8.2 < 8.2.35
- PHP 8.3 < 8.3.36
- PHP 8.4 < 8.4.27
- PHP 8.5 < 8.5.12
In addition, there are versions that do not receive the patch because they are no longer supported. These are:
- PHP 5.6
- PHP 7.2
- PHP 7.4
- PHP 8.0
If you're using any of these versions, you'll need to switch to a supported version to be protected.
To check which version of PHP you're using:
- Go to your hosting service in SWPanel.
- Enter Settings.
- Look for the PHP section.
- There you'll see the current PHP version your website is using.
What we do in SWPanel
Our team has applied the patch to all managed servers. This includes PHP versions that are still supported and were affected by these vulnerabilities. The patch was applied on October 22, 2026.
For managed servers, we also check if there are PHP versions that are no longer supported and notify you so you can update them.
What you need to do
- If you're using an unsupported version (like PHP 5.6, 7.2, 7.4, or 8.0), switch to a supported version from the panel:
- Go to your hosting service in SWPanel.
- Enter Settings.
- In the PHP section, select a supported version (like 8.2.35 or higher).
- Save the changes.
- If your server is not managed by us, you'll need to apply the patch yourself or ask the person who administers it to do so. In this case, update PHP to a corrected version (8.2.35, 8.3.36, 8.4.27, or 8.5.12).
- If you're using a supported version managed by us, you don't need to do anything. You're already protected.
Frequently asked questions
Do I have to pay anything?
No, there's no additional cost. The patch is applied automatically on managed servers.
How do I know if I'm already protected?
If you're using a supported version on a server managed by us, our team has already applied the patch. You can check your PHP version in the panel, under Settings > PHP.
What if I'm using an unsupported version?
Unsupported versions do not receive the patch. You'll need to switch to a supported version from the panel, under Settings > PHP. If your website is old, you may need to check that it works correctly with the new version before switching.
And if your server is not managed by us?
In that case, you'll need to apply the patch yourself or ask the person who administers it to do so. Update PHP to a corrected version (8.2.35, 8.3.36, 8.4.27, or 8.5.12).
Need help?
If you have any questions or need help changing the PHP version, you can open a support ticket from SWPanel. To do this:
- Go to your control panel.
- Enter Support.
- Select Open ticket.
- Choose the Security category and describe your query.
