Last updated: Oct 22, 2026, 09:00 UTC
Status: Patch rollout in final stage. No action needed from customers.
The PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP.
Cloudways has deployed interim mitigations across the fleet and is completing the rollout of official security patches.
This article explains what happened, what we have done, and what you can do.
Current status
The majority of servers are now patched, and our team is completing the remaining instances.
Patching is expected to be completed by 09:00 UTC on Oct 22, 2026.
Security patches have been applied to all customer applications hosted on Autonomous.
Patches are still being deployed to applications hosted on Flexible, and the rollout is on schedule.
Interim protections remain in place until all patching is complete.
No action is needed from you.
What happened?
On Oct 21, 2026, the PHP Group disclosed critical vulnerabilities that could allow remote code execution in affected PHP environments.
PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, so we notified all customers the same morning.
The PHP Group began releasing official patches on 21 October 2026 at 14:00 UTC.
This is an industry-wide vulnerability in the open-source PHP language and is not specific to Cloudways.
What has Cloudways done?
Interim mitigations: We deployed configuration-level mitigations recommended by the PHP Group across the fleet to add a layer of protection while patches were prepared.
Patch rollout: We are applying official security patches across all Cloudways-supported PHP versions, including deprecated versions. The rollout covers PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding patch for each version.
Deprecated PHP versions: For versions that no longer receive official security updates, we worked with our Extended Long Term Support (ELTS) partners to apply the appropriate security patches.
Impact: This maintenance does not affect the availability or operation of the Cloudways Platform, customer websites, or Affiliate Portal services.
What should I do right now?
No action is required. Our Engineering team is applying patches at the platform level, so you do not need to install anything. These steps are good practice:
Keep your applications up to date. Update your CMS (WordPress, Magento, Laravel, etc.), plugins, themes, and extensions.
Remove what you don’t use. Delete inactive plugins, themes, and abandoned applications.
Review access and logs. Check for unfamiliar admin users, unexpected files, or unusual traffic, and rotate passwords and keys if anything looks suspicious.
Take regular backups. Create a manual backup before any PHP version change or major update.
Plan to move off deprecated PHP versions. Test your application on a staging environment first.
How to verify the patch on your server
You don’t need to do anything for the patch to be applied, but if you’d like to confirm it on your server, you can check the PHP build date over SSH.
Step #1 - Connect to your server over SSH:
If you’re not sure how, follow our guide: Guide to Connecting to Your Application Using SSH/SFTP
Step #2 - Run the following command:
for p in /usr/bin/php[0-9].[0-9]; do [ -x "$p" ] && "$p" -i 2>/dev/null | awk -v p="${p##*/}" '/^PHP Version =>/ && !v {v=$4} /^Build Date =>/ {print p, "| PHP", v, "| Build Date:", substr($0,index($0,"=>")+3); exit}'; doneStep #3 - Check the output:
The command lists each PHP version installed on your server with its build date. The format looks like this (the values below are only an example):
php8.2 | PHP 8.2.xx | Build Date: Oct 21 2026 xx:xx:xx
Build date of 21 October 2026 or later: that version has the security patch.
Frequently asked questions
Do I need to do anything on my end?
No. Our Engineering team is deploying the patches automatically at the platform level. Regular backups are still recommended as a general best practice.
Has the patch been applied on my server yet?
The majority of servers are patched, and we expect all patching to be completed by 09:00 UTC on Oct 22, 2026. Autonomous applications are fully patched, and Flexible applications are being completed. Follow our status page for the final confirmation.
If you’d like to check your server yourself, see the steps in the ‘How to verify the patch on your server’ section above.
Which PHP versions are being patched?
All Cloudways-supported PHP versions, including deprecated ones, covering PHP 5.6 and above. The rollout includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4.
I’m on a deprecated or end-of-life PHP version. Am I protected?
Yes. We are applying security patches to deprecated versions through our ELTS partnerships. We still recommend moving to a supported PHP version when your application is compatible.
Do I need to upgrade my PHP version to get the patch?
No. Patches are being applied to your current PHP version. If you want to upgrade for performance or long-term support, take a full backup and test compatibility first.
Is there a workaround or temporary fix I should apply?
No. Interim configuration-level mitigations recommended by the PHP Group have already been deployed across the fleet and stay in place until patching is complete. You do not need to take your site offline or add firewall rules yourself.
Will there be downtime or service restarts?
This maintenance does not impact the availability or operation of the Cloudways Platform or customer websites. Patching PHP services can involve a brief service restart with minimal impact.
Can you patch my server? I can’t connect or don’t have steps to fix this.
Yes, and you don’t need to do anything. PHP updates are handled by our Engineering team at the platform level.
If my server is in a Stopped state, will it prevent the patch from being applied?
Patches cannot be applied to servers that are stopped or powered off. Once you start your server, our system will apply the updates automatically.
Is this issue specific to Cloudways?
No. It is an industry-wide vulnerability in open-source PHP that affects all hosting providers.
How will I be notified of updates?
We will send updates by email and keep our status page current. We will share a final update once patching is complete.