Security notice ·
On 21 October 2026 the PHP project fixed two critical vulnerabilities, known together as "php2shell". Both can allow an unauthenticated attacker to run code on a server that runs PHP. We updated PHP on Skyline Cloud hosting on 22 October. Here is who is affected and what you need to do.
Not sure which PHP version your site uses? Ask us and we will check.
When PHP runs out of memory, its out-of-memory handling can interrupt it while internal request data is only partly set up. The cleanup that follows may then treat that invalid data as valid. Advisory GHSA-w8hw-w9fx-j79w.
Internal state that belongs to one request can survive after its memory has been freed, and a later request on the same PHP worker may use it. Advisory GHSA-6wmf-4rv5-p3rp.
Any website or application on a PHP version without these fixes, where PHP serves web requests. WordPress, Laravel and custom PHP code all run on the same engine, so the framework does not change the answer.
| PHP branch | Fixed version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Supported |
| 8.1, 8.0, 7.4 | No official release | End of life. Source backports only, for people who build PHP themselves |
PHP 8.1 and older no longer receive official releases. The PHP team published source backports for 7.4, 8.0 and 8.1 for anyone building from source, and its advice is to upgrade to a supported version.
On 22 October 2026 we updated PHP on our Skyline Cloud hosting servers and our web platform servers to the fixed versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) and restarted PHP. We checked customer sites after the update.
For sites still on PHP 7.4, 8.0 or 8.1 we installed the latest LiteSpeed builds. The PHP project no longer publishes official fixes for those versions, so we cannot describe them as fully patched, and we are asking those sites to move to a newer version.
Nothing. Your site already runs a fixed version.
We strongly recommend switching the site to PHP 8.2 or newer. In S Panel, open the PHP version selector for the website and choose 8.2, 8.3, 8.4 or 8.5. Older code sometimes needs small changes on a newer PHP version, so if you are not sure your site is ready, open a support ticket first and our team will help you test it before you switch.
On a server you manage yourself, applying the update is your job:
If you would like help, open a support ticket and tell us which server it is.
WordPress runs on PHP, so what matters is the PHP version, not WordPress itself. If your site is on Skyline Cloud Hosting with PHP 8.2 or newer, it is already updated.
No. We restarted PHP after the update on 22 October 2026.
The PHP project says updating is the only complete fix. Update PHP, or move to a supported version.
PHP 8.1 and older get no official fixes. We installed the latest LiteSpeed builds for them, but the recommended fix is to move to PHP 8.2 or newer in S Panel. Support can help you test the site first.
No. A self-managed server is yours to update: upgrade PHP from the source you installed it from, then restart PHP-FPM and the web server. Open a support ticket if you would like help.
This notice is also on the Skyline blog. Related: Skyline web hosting plans.
Tell us the domain or server and the PHP version it runs, and we will take it from there. You can also email sales@alskyline.com.
SAR 50 free credit — code SKY30 at signup
No card to start. Enter code SKY30 when you sign up and your wallet opens with SAR 50 of credit.