PHP Security Updates from 2026-10-21 14:51 UTC to 2026-10-21 17:52 UTC

The fixes have been fully deployed so everything is now securely patched. Thank you for your patience!

Many customers are naturally concerned about the PHP vulnerabilities that have just been discovered. As soon as we heard about them, we took precautionary mitigation steps while waiting for the official security updates to be released. These included disabling PHP’s session upload progress functionality by default and introducing additional WAF protection to block potentially malicious requests.

As the official PHP security patches have now been released, we are currently rolling them out and expect to have this completed soon. We will update here on our status page to officially confirm the completion of this.

To clarify, all versions of PHP will have the security fixes implemented, including older versions which will be backported.

As a Lyrical Host customer, you don’t need to take any action. However, if you have any concerns or would like to check anything with the team, especially if this has made you realize you’re running a very old version of PHP and want to update safely, please create a support ticket from your account. While you can update PHP yourself from LyricalCP, we advise getting our support team’s help/advice on this first as sometimes it can break plugins and other website functionality, especially if you’re updating from a significantly older version.

Please note that we understandably have a higher volume of queries at the moment but we will get back to you as soon as possible.

Thank you for your patience :)