Updated: 22 October 2026
Two critical security vulnerabilities have recently been identified in PHP, the programming language that powers WordPress and many other websites and web applications.
PHP has now released security updates to address the vulnerabilities, and we have been working with our hosting partners to ensure affected servers are updated as quickly as possible.
What is the issue?
PHP has disclosed two critical vulnerabilities that could potentially allow an attacker to execute malicious code on a server.
In simple terms, the vulnerabilities could allow an attacker to exploit the way PHP handles certain types of data and potentially gain the ability to run their own code on the server.
The two vulnerabilities are:
Remote Code Execution via Out-of-Memory corruption
PHP can mishandle data when the server runs out of available memory. Under certain circumstances, this could allow an attacker to manipulate the PHP process and potentially execute malicious code on the server.
Remote Code Execution via stale global state
PHP can accidentally retain and reuse data from a previous request. Under certain circumstances, an attacker could potentially exploit this behaviour to execute malicious code on the server.
Both vulnerabilities are considered critical because successful exploitation could give an attacker a significant level of control over an affected server.
Which versions are affected?
The PHP project has released patched versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older versions no longer receive security updates from the PHP project. Some hosting providers may, however, provide security fixes for older PHP versions independently.
What is UP Hotel Agency doing?
The action required depends on where your website is hosted.
WP Engine customers
For websites hosted with WP Engine, we have been working closely with their security and support teams throughout the release.
WP Engine implemented additional protective measures at the CDN layer while the PHP patches were being released and subsequently began rolling out the updated PHP versions across its platforms.
We can confirm that the affected PHP versions running on the WP Engine servers hosting our customers’ websites have now been patched.
No action is required from you to secure your website.
Customers hosted on our Mid Servers
For websites hosted on our own Mid Server infrastructure, we have worked with our hosting partners to apply the necessary security updates.
The affected PHP versions running on our servers have now been patched.
No action is required from you to secure your website.
Customers using managed hosting elsewhere
If your website is hosted through another managed hosting provider, such as a specialist WordPress hosting company, cloud provider or managed server provider, they should be responsible for applying the PHP security updates.
We recommend checking your provider’s latest security announcements to confirm that the appropriate patches have been applied.
If you’re unsure whether your hosting provider has addressed the issue, please contact us and we can help you establish what action may be required.
Customers managing their own dedicated server
If your website is hosted on a server that you or your organisation manages directly, you will need to ensure that PHP has been updated to a patched version.
We recommend checking that you are running one of the following versions, where supported:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you are running PHP 8.1 or older, you should also consider upgrading to a currently supported PHP version.
You can find the latest information directly from the PHP project at php.net.
What should customers do?
For websites hosted by UP Hotel Agency or WP Engine, there is no further action required to protect your website from these PHP vulnerabilities. We have already ensured the relevant updates have been applied.
However, PHP is also used by many other services and systems outside of your website.
We recommend reviewing any other services you use with third-party providers, particularly those that process or store sensitive information. This could include:
- Booking engines
- Gift voucher platforms
- Payment or ecommerce systems
- Guest management systems
- CRM platforms
- Internal business applications
- Other web applications hosted on your own servers
If these systems use PHP, their providers should also confirm that the appropriate security updates have been applied.
A note about older PHP versions
PHP versions eventually reach the end of their supported lifecycle and stop receiving security updates from the PHP project.
While some hosting providers, including those supporting older versions for compatibility reasons, may backport important security fixes, we strongly recommend keeping websites on a currently supported PHP version wherever possible.
This helps ensure that future security vulnerabilities can be addressed promptly and reduces the risk associated with running outdated software.
Summary
Two critical vulnerabilities have been identified in PHP that could potentially allow attackers to execute malicious code on affected servers.
The good news is that patches are now available and the affected PHP versions on our own hosting infrastructure and WP Engine platforms have been updated.
If your website is hosted with UP Hotel Agency or WP Engine:
No action is required from you.
If you use another managed hosting provider, we recommend confirming that they have applied the relevant PHP security updates.
If you manage your own server, please ensure that you are running a patched PHP version and review the latest guidance from the PHP project.
As always, if you’re unsure whether your website or hosting environment is affected, please get in touch with our team and we’ll be happy to help.
