All Truehost cPanel shared hosting servers have been patched across every PHP version we support.

Shared hosting customers: although patched, sites on PHP 8.1 or older are on end-of-life versions that no longer receive upstream security fixes. We strongly advise upgrading to PHP 8.2 or later. Before you switch, confirm that your website, theme and plugins are compatible with PHP 8.2+.

VPS and dedicated server customers: we have emailed you step-by-step instructions for applying the PHP updates. We do not manage the software stack on your server, so if your server runs PHP, please apply the measures in that email as soon as possible.

If you need help, our support team can patch your server for you. Open a support ticket from your client area, or email support@truehost.cloud, with your server hostname and IP address, and our team will follow up with you on secure access.

Two critical security flaws have been found in PHP, the software that powers WordPress and most websites. Attackers could use them to take over a website without logging in. PHP released a fix today and we are rolling it out across our servers.

Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35

No fix available: PHP 8.1, 8.0, 7.x and 5.x

Shared, WordPress & Reseller Hosting — we handle this

• Extra firewall protection is already active on all servers.
• Patched PHP will be installed tonight. Your site may be unavailable for a few seconds during this window.
• Action needed only if your site uses PHP 8.1 or older: switch to PHP 8.3 before 29 October. In cPanel, open Select PHP Version or MultiPHP Manager.
• From 22 October, sites still on unsupported versions will be moved to PHP 8.3 automatically.

WordPress tip: go to Tools → Site Health → Info → Server to see your PHP version. Update your plugins and theme before switching.

Self-managed VPS, Cloud Servers & Dedicated Servers — action required

You are responsible for updating PHP on servers you manage. Update every PHP version installed, not just the default one.

• cPanel / WHM: update the ea-php packages through EasyApache 4 once cPanel publishes them.
• CyberPanel: update the lsphp packages, then restart LiteSpeed.
• CWP: rebuild each PHP version from the PHP selector.
• No panel / custom: update with apt or dnf, then restart PHP-FPM and your web server.

Check each version with php -v. If you can't update yet, set session.upload_progress.enabled = 0 in php.ini and restart PHP. This reduces the risk but is not a fix.

Signs of a problem

Contact support immediately if you notice unknown files, new admin users, strange redirects or emails you didn't send.

We will update this notice when patching on shared hosting is complete.