Update - 22/10/2026, 12:31pm
For updates on our patching and mitigation progress, see sitehost-status.net.
Update - 22/10/2026, 10:45am
We've updated Cloud Container images for PHP 8.2, PHP 8.3, PHP 8.4 and PHP 8.5 to address the PHP security vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Cloud Container images listed below have already been updated and are available now:
Nginx (PHP 8.5, 8.4, 8.3, 8.2)
Apache (PHP 8.5, 8.4, 8.3, 8.2)
WordPress (PHP 8.5, 8.4, 8.3, 8.2)
Silverstripe (PHP 8.3)
If you are running any version of PHP earlier than 8.2, and you can update to a newer version, we recommend updating ASAP.
To update Cloud Container images
You can update your Cloud Container images from the Control Panel. Open the Containers screen, then click the NV tag ("new version") that displays alongside images that are ready to update.
Managed Cloud Containers
We are in the process of rolling out automatic updates to managed Cloud Container customers. This work is ongoing. If you can update your own images now, this would be the safest course of action.
Unmanaged Cloud Containers
If you're using unmanaged Cloud Containers, please log in to the Control Panel and manually update containers to the latest available image. We highly recommend that you do this as soon as possible.
Custom Cloud Container images
If you're using a custom Cloud Container image based on one of our PHP images (eg. Apache, Nginx, WordPress), update the base version of the image, rebuild and update it as soon as possible.
We will provide further updates as the rollout progresses.
Update (21/10/2026): To help your sites from these critical PHP vulnerabilities we have disabled PHP's session.upload_progress.enabled setting for all SiteHost servers and customers. This setting is On by default, but for most websites it's unlikely to make any practical difference to you or your customers.
The change should help mitigate potential attacks, and we don't expect it to affect normal website functionality or file uploads. However, websites that specifically rely on PHP's built-in upload progress tracking may experience some impact. If you accept file uploads via any websites, that functionality could be affected.
If you notice any unexpected behaviour on your website following this change, please email support@sitehost.nz so we can investigate.
PHP has announced an urgent security update for two critical vulnerabilities that will be rolled out overnight tonight. Both vulnerabilities were given severity ratings of 9.2/10. They reportedly expose remote control execution vulnerabilities in PHP, which could potentially enable attackers to run their own code on a server and take control of it.
Their security team is aiming to release the fixes overnight at 3am New Zealand time.
As soon as the update is available, we’ll be updating Cloud Container images and tagging them with the NV (new version) flag. When you see the NV flag, you can then click and update the image. We very strongly encourage you to click and update your Cloud Containers when new images are available.
Differences for managed and unmanaged Cloud Containers
If you don’t update your Cloud Container images when the new PHP versions are available, there are some differences depending on your setup.
Managed Cloud Containers
If you’re using Managed Cloud Containers, we’ll release the updated image and bring forward your scheduled maintenance cycle so you can receive the updated PHP version sooner, rather than waiting for your usual maintenance window. For more information on Automatic Container Updates, check out our Knowledge Base.
Unmanaged Cloud Containers
If you’re using unmanaged Cloud Containers, your Container images will not be automatically updated. We urge you to upgrade your Container images as soon as the fix is available. And if you’d rather not be responsible for rolling out patches in the wee small hours, consider adding Server Management.
Factors that could complicate your Cloud Container image upgrades
If you’re running Cloud Containers with custom PHP-forked images it’s a bit trickier. You will need to clone your repository, and upgrade your image on your local machine before redeploying the fixed version.
And if you’re running Cloud Containers on images with older PHP versions we suggest that you update PHP to a version to make sure it’s still receiving security updates (at least PHP 8.2). This is a change you can make right now.
Running PHP on other servers?
If you’re running PHP-based applications on Virtual Servers, or Reserved Virtual Servers, we will be updating the PHP versions for managed servers as they become available.
If you’re running PHP on unmanaged servers, we recommend checking if a PHP release is available as soon as you can.
Another day, another vulnerability
Just earlier this week we reported a new critical Linux kernel vulnerability. Vulnerabilities are being discovered more quickly and more frequently than ever before, and they’re also being exploited much sooner.
If patching images at 3am isn’t something you want to be doing manually, we totally understand. This overnight patching is a perfect demonstration of the value of Server Management.
If you’d like to talk with us about adding Server Management, we’re always ready to hear from you.
FAQ
What’s happening and what do I need to do?
PHP has announced two critical security issues. We’ve put a change in place that may help mitigate the issues, and will be updating our Cloud Container images as soon as possible. Managed Containers will have their updates handled by us, but for unmanaged containers you will need to manually update images when the NV flag appears in the Control Panel.
What if I’m on an older PHP version or an unmanaged server?
We don't know which PHP versions will be vulnerable or when they will get a patch. The safest thing to do is be on the most recent version of PHP you can (PHP 8.2+). We can’t access unmanaged servers, so you’ll need to update PHP yourself and turn off session.upload_progress.enabled in the meantime.
Will the temporary fix break my uploads?
No, it shouldn't. The most common impact will be to some progress bars potentially getting stuck on 0% or failing to show progress.
Will updating my Container image reset my config?
No. Your php.ini and Apache config stay as they are, unless you tick “Use latest default configurations for this image?” when you update. Leave that box unticked if you’ve customised anything.