The PHP Group has disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP.
Cloudways Security is closely monitoring the situation and has begun applying interim mitigations to strengthen affected PHP environments while we wait for official patches.
This article explains what is happening, what we are doing, and what you can do now.
What is happening?
The PHP Group has announced critical vulnerabilities that could allow remote code execution in affected PHP environments.
Official patch releases are expected to begin on 21 October 2026 at 14:00 UTC. Availability will vary by PHP version.
Until patches are released and rolled out, Cloudways is applying interim safeguards to reduce risk.
What is Cloudways doing?
Active monitoring: Cloudways Security is tracking the vulnerabilities and the PHP Group’s release schedule.
Interim mitigations: We are implementing temporary protective measures on affected PHP environments.
Patch rollout: Once official patches are available, we will validate and deploy them.
Deprecated PHP versions: For versions that no longer receive official security updates, we are using our Extended Long Term Support (ELTS) partnerships to maintain security coverage and address the vulnerabilities where official patches may not be available.
What should I do right now?
No emergency action is required from you at this time. These steps are good practice and will help you stay protected:
Keep your applications up to date. Update your CMS (WordPress, Magento, Laravel, etc.), plugins, themes, and extensions to their latest versions.
Remove what you don’t use. Delete inactive plugins, themes, and abandoned applications.
Use a supported PHP version. If you are on a deprecated version, plan an upgrade after testing your application for compatibility. Test on a staging environment first.
Take a backup. Create a manual backup of your applications before any PHP version change or major update.
Review access and logs. Check for unfamiliar admin users, unexpected files, or unusual traffic, and rotate passwords and keys if anything looks suspicious.
Frequently asked questions
Do I need to upgrade my PHP version?
Not necessarily right now. We will share guidance once patches are released. If you are on a deprecated version, we recommend planning an upgrade as a best practice.
I’m on a PHP version that has reached the end of life. Am I protected?
We are using our ELTS partnerships to provide security coverage for deprecated PHP versions where official patches may not be available. We still recommend moving to a supported version when possible.
How will I be notified of updates?
We will send updates by email and keep the status page current as new information becomes available.
Will the patch be applied automatically, and when?
For supported PHP versions (8.2 and later), the PHP Group is releasing official patches today at 14:00 UTC. We are ready to apply patches to your server as soon as they are available. We have our status page updated and will update once this activity is complete. You can follow updates on our status page for more details.
Are older versions (7.4, 8.0, 8.1) covered?
Official patches are expected for supported PHP versions only (8.2 and later). For older versions, our engineering is working with Extended Long Term Support partners to maintain security coverage and we will share timelines as soon as it is confirmed. We have our status page updated already and you can follow updates on the status page for more details.
Is there a Workaround or temporary fix available?
Our Security team is applying temporary, partial mitigations to reduce exposure while official patches are pending. They do not fully mitigate the vulnerabilities or replace the patch, actual fix is awaited and these are temporary harding measures to reduce the chance of vulnerability exploit.We will share more on this and also when fix is made available and deployed.
Has the patch been applied on my server yet? (use after release)
The official patches were released on 21 October at 14:00 UTC and our Engineering team is rolling them out. We have our status page updated and will update further once this activity is complete. You can follow updates on our status page for more details.
Can you patch my server? I can’t connect or do not have steps to fix this.
PHP updates are handled by our engineering team at the platform level, so you do not need to install anything. We will apply the patch as soon as it is available. We have our status page updated and will update once this activity is complete. You can follow updates on our status page for more details.
Is this issue specific to Cloudways?
No. This is an industry-wide vulnerability in the open-source PHP language that affects all hosting providers. Our Security and Engineering teams are working on it with highest priority.
Should I upgrade my server to PHP 8.2 or 8.3?
While our team is actively working with ELTS partners to deploy security coverage for older PHP versions (7.4, 8.0, 8.1), the patches will be available by 14:00 UTC today for php version 8.2+
If your application (such as WordPress, Laravel, Magento, or custom code) is fully compatible with PHP 8.2 or higher, we recommend upgrading your PHP version via your Cloudways dashboard. Upgrading gives you immediate access to official upstream patches and better overall performance.
Note:
Please ensure you take a full application backup and verify application compatibility before upgrading your PHP version.
Will there be any downtime or service restarts required during the patch?
Patching standard PHP services usually involves a quick service restart with minimal impact. However, as our Security team evaluates the full scope of the vulnerability, additional mitigations may be necessary. We are taking every precaution to minimize downtime and recommend following our status page for live rollout updates.
Do I need to do anything on my end?
No action is required on your end. Our Engineering team is handling the patch deployment automatically at the platform level. However, taking regular backups of your application is always recommended as a general best practice.
Should I take my site offline or add rules myself?
No, you do not need to take your site offline or manually add firewall rules. Our Security / Engineering team has already implemented platform-level mitigations to reduce potential exposure while the permanent security patches are being awaited to be released and are going to be deployed
If I have a server in Stopped state, will it prevent the patch from being applied?
Yes, patches cannot be applied to servers while they are stopped or powered off. Once you start your server, our system will apply the updates automatically to ensure your environment is fully protected.