Emergency PHP security maintenance

The emergency PHP security maintenance across our fleet of servers is complete. We've applied and verified the official security updates and backported fixes for CVE-2026-109618 and CVE-2026-109619 across all remaining installed PHP versions.

PHP 4.4, 5.1 and 5.2 have also been retired. Our usage checks found no sites using these versions. Existing site PHP selections, customer applications and data remain unchanged.

Thank you for your patience while we carried out this work.

We're carrying out emergency security maintenance across our fleet of servers following the disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

We've begun applying verified security fixes and are checking the remaining PHP installations for compatible updates. The work is ongoing.

We're also checking for sites using PHP 4.4, 5.1 and 5.2 ahead of retiring those versions. We'll provide a further update once those checks are complete.

This maintenance does not include changes to customer applications or data. We'll update this notice as the work progresses. Thanks for your patience.