PHP CVE Security Updates & Patching

Incident Report for SiteHost

Resolved

We have completed today's work to update images on unmanaged Cloud Containers, completing our planned action.
Posted Oct 27, 2026 - 14:04 NZDT

Update

In rare circumstances, described below, PHP services can still be vulnerable even after recent patching. If the below conditions, which combine configuration and application code, apply then you ought to disable session upload progress as mitigation.

- The application sets `session.serialize_handler` to `php_binary` or `php_serialize` in its configuration, AND
- The application then switches `session.serialize_handler` to `php` at runtime with `ini_set()` before `calling session_start()`.

In this situation, please set `session.upload_progress.enabled = 0`.

Applications that never change the serialize handler at runtime are not affected.

Since this setup is unlikely in practice, it will be addressed through regular releases.
Posted Oct 27, 2026 - 10:57 NZDT

Update

We are in the process of patching all unmanaged Cloud Containers that are still running unpatched versions of PHP. There's still time to run your own updates, which we recommend since we do not monitor unmanaged Cloud Containers. Please also test your websites after PHP has been updated.
Posted Oct 27, 2026 - 10:27 NZDT

Monitoring

At this time we’ve patched all managed servers, updated Cloud Container images and made updates (or mitigation advice) available for unmanaged servers. Despite these patches and mitigations the best advice is still to update to PHP 8.2 or higher, everywhere you can. This helps ensure you get security fixes quickly, the updates are smaller and you aren’t relying on back-ported fixes.

We’ll continue to monitor the situation closely and provide further patches or updates as needed.
Posted Oct 22, 2026 - 22:33 NZDT

Update

Further Cloud Container images running older versions of PHP now have back-ported patches in place.

These updates have already been applied to managed Cloud Containers. For unmanaged containers, now is the time to log into the SiteHost Control Panel and update to the latest version of the image.

Our strongest advice remains to update to PHP 8.2+ as soon as possible.

These updates are, by necessity, more comprehensive than updates to images running PHP 8.2+. That means there’s a higher risk that they could affect website functionality. Please check that your sites are working as they should.

This round of updates included the the below images:

- Nginx: PHP 5.6, 7.0, 7.1, 7.2, 7.3
- Apache: PHP 5.6, 7.0, 7.1, 7.2, 7.3
- WordPress: PHP 7.1, 7.3, 7.4, 8.0
Posted Oct 22, 2026 - 22:12 NZDT

Update

Cloud Container web images with some older versions of PHP now have backported patches in place. These images are already applied to managed Cloud Containers. For unmanaged Cloud Containers, now is the time to log into the Control Panel and update to the latest version of the image.

Our strongest advice remains to update to PHP 8.2+ as soon as possible.

These backported image updates are, by necessity, more comprehensive than updates to images running PHP 8.2+. Consequently there’s a higher risk that they could affect website functionality. Please check that your sites are working as they should.

Cloud Container web images with backported PHP patches are:

- Nginx: PHP 8.1, 8.0, 7.4
- Apache: PHP 8.1, 8.0, 7.4
Posted Oct 22, 2026 - 16:47 NZDT

Update

We have applied the recommended mitigations to all Cloud Containers running PHP 5.2-5.5, except for custom images. These mitigations are not a complete solution, and they can affect website functionality. Please test your websites, especially those with file upload functions. We still strongly advise updating to PHP 8.2 or higher as soon as possible.
Posted Oct 22, 2026 - 14:50 NZDT

Update

Cloud Container images with patched versions of PHP are:

- Nginx: PHP 8.5, 8.4, 8.3, 8.2
- Apache: PHP 8.5, 8.4, 8.3, 8.2
- WordPress: PHP 8.5, 8.4, 8.2
- Silverstripe: PHP 8.3

For images running PHP 8.1 or earlier, we are investigating backporting patches. Those images are:

- Nginx: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1, 7.0, 5.6
- Apache: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1, 7.0, 5.6
- WordPress: 8.1, 8.0, 7.4, 7.3, 7.2, 7.1

If you are running one of these older versions, our best advice remains to update to PHP 8.2 or higher as soon as you can.
Posted Oct 22, 2026 - 13:50 NZDT

Update

For managed servers running Plesk, we have:
- Updated all versions of PHP from 8.2 up.
- Applied the recommended mitigations to earlier versions of PHP. These are not a full solution and can affect website functionality like file uploads, so if you are running PHP 8.1 or older, we recommend updating to a newer version as soon as possible.
Posted Oct 22, 2026 - 12:28 NZDT

Update

We have finished updating all managed Cloud Containers running images with PHP 8.2 or later. Patches were applied directly to the server, and correct image versions will now be shown in the Control Panel.

Please log into the Control Panel and check that your images are up to date. If you still see an 'NV' (new version) tag, either click it to start your own update or contact support@sitehost.nz.

If you are running custom images, you will need to update these. For images based on one of our PHP images (eg. Apache, Nginx, WordPress), update the base version of the image, rebuild, and update it as soon as possible.
Posted Oct 22, 2026 - 11:55 NZDT

Update

We have finished patching all installed PHP versions on all managed servers running cPanel.
Posted Oct 22, 2026 - 11:37 NZDT

Update

Updated Cloud Container images are now available for:
- Nginx (PHP 8.5, 8.4, 8.3, 8.2)
- Apache (PHP 8.5, 8.4, 8.3, 8.2)
- WordPress (PHP 8.5, 8.4, 8.3, 8.2)
- Silverstripe (PHP 8.3)

We are handling updates for managed Cloud Containers and will post an update once this work is finished. Because we are applying patches directly to the server, there will be a lag between the update happening and that change being reflected in the Control Panel.

For unmanaged Cloud Containers, we recommend that you update images as soon as possible.
Posted Oct 22, 2026 - 11:11 NZDT

Update

We recommend that customers running older PHP versions (PHP 8.1 or older) upgrade to a currently supported version as soon as possible. Older PHP versions that have reached end of life no longer receive security updates from the PHP project, potentially leaving websites exposed to known vulnerabilities.

We will be rolling out automatic image updates to Managed Cloud Container customers only. Customers using un-managed Cloud Containers can log in to the SiteHost control panel and manually update their container to the latest available image.
Posted Oct 22, 2026 - 08:38 NZDT

Identified

We have updated the Cloud Container images for PHP 8.2, PHP 8.3, PHP 8.4 and PHP 8.5 to address the security vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.

We are now rolling out these updated images across our Cloud Container servers. Automatic updates may take some time to reach all customers.

If you would like to apply the update sooner, you can manually update your Cloud Container to the latest image version through the SiteHost control panel.

We will provide further updates as the rollout progresses.
Posted Oct 22, 2026 - 07:24 NZDT
This incident affected: Cloud Containers (NZ – AKL01, NZ – AKL02, NZ – AKL03, US – CAL01, UK – LDN01, SG – SGP01, AU – SYD01, DE - FRA01).
← Current Status Powered by Atlassian Statuspage