We are aware of a remote code execution exploit in all current PHP versions. Patches are due to be released for versions 8.2 and above at 14:00 UTC, and we will deploy them as soon as they become available. If your site runs a lower version, you may need to upgrade unless they release patches for these versions. Please ensure you take a backup before upgrading PHP on your site. You can read the official notice here - https://news-web.php.net/php.announce/509
We are implementing mitigations in an effort to secure all versions until updates can be applied. This is being implemented across all sites this morning; you may experience a small amount of downtime whilst the PHP services are restarted.
We will update this status once we have more information
22nd October 2026, at 8:22AM
WordPress Hosting accounts on our current platform have been updated to patched versions of PHP. If you are on version 8.2 or above this has already been applied.
If you are on a version below 8.2 we will be upgrading your PHP to a patched version and will be in touch when this is happening, you can however upgrade your version manually by selecting it in your control panel, please follow this guide if you wish to do so: https://www.34sp.com/kb/how-to-change-php-version-on-wordpress-hosting
Those accounts on our legacy platform (you will see in your control panel that you can't choose PHP higher than 8.0) are being migrated to allow updates. We will contact customers with these accounts individually and are working through the updates as quickly as possible.
All Reseller Hosting accounts have now been updated with patched releases of PHP.
Professional accounts on our modern cluster hosting platform have been updated. Accounts still held on our legacy platform will be contacted regarding a migration to the cluster hosting platform shortly.