New PHP Vulnerability (CVE-2026-115560), WPhost clients already protected

Our Security Team has reviewed the new vulnerability affecting PHP noted in CVE-2026-115560 and existing site-level mitigations already protect customers against exploitation. No further action is needed at this time.

The following PHP versions have had patches roll out across our infrastructure: 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4.

Our firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

WPhost has finished the deployment of security patches for two critical PHP vulnerabilities on all Bronze, Silver, Gold, Platinum and Agency plans. The patch has been applied to your PHP version, and no action is needed from you.

Updates for PHP 8.4, 8.2, 8.1, and 7.4 on eCommerce and Enterprise plans are still undergoing validation and will be rolled out once ready. The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. No action is required on your end.

We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks.

We are currently deploying patches for the WPhost platform. Protective mitigations are still active at the CDN layer and at the host layer. Further updates will be provided as they are available.

As widely reported, two critical vulnerabilities were recently identified in PHP, the core programming language powering WordPress. Our security teams have been actively monitoring the situation and implementing several mitigating actions.

As of 2:40 AM NZDT today, PHP has begun to release patches and other mitigating steps to resolve the vulnerabilities. Our team is working to roll out these updates across all customer platforms as soon as possible. In addition, we have already deployed protective mitigations at the CDN layer via Cloudflare and Fastly.

We will share further updates as deployment progresses.