We are aware of a remote code execution exploit in all current PHP versions. Patches are due to be released for versions 8.2 and above at 14:00 UTC, and we will deploy them as soon as they become available. If your site runs a lower version, you may need to upgrade unless they release patches for these versions. Please ensure you take a backup before upgrading PHP on your site. You can read the official notice here - https://news-web.php.net/php.announce/509
We are implementing mitigations in an effort to secure all versions until updates can be applied. This is being implemented across all sites this morning; you may experience a small amount of downtime whilst the PHP services are restarted.
We will update this status once we have more information
21st October 2026, at 9:34PM
Available updates are rolling out now.