The internet is scrambling to patch a critical PHP flaw. If you’re hosted with WHC, you’re not.

Last updated: October 22, 2026

A critical security vulnerability in PHP, the software that runs most of the websites on the internet, is making headlines across Canada and around the world.

If your website is hosted with WHC, here’s the short version: our team is already on it, and the large majority of our customers are protected.

Now the longer version, because you deserve to know what’s happening and what, if anything, you need to do.

What’s happening with PHP

On October 21, 2026, cybersecurity researchers disclosed two critical vulnerabilities in PHP, nicknamed “PHP2Shell.”

PHP is a programming language that works behind the scenes to make websites function, display content, and communicate with databases. Nearly 70% of websites worldwide use PHP, including most WordPress, Drupal, and Joomla sites.

That’s why this vulnerability is making so much noise.

In plain English: without a security patch, these vulnerabilities could allow hackers to run malicious code on an unprotected server. That's serious. It's why PHP released emergency security patches today, and why the story is making headlines.

The key words here are “unprotected server.” Once patched, that door is closed.

What WHC has done to keep you protected

As soon as the vulnerability was made public and a security patch became available, our security team got to work applying it across our servers.

Good news: All servers managed by WHC are now protected.

This covers the vast majority of our clients. If you use our Web Hosting, WordPress Hosting, or Reseller Hosting services, or run on a VPS or Dedicated Server managed by WHC, there’s nothing you need to do. We’ve taken care of it for you.

This latest vulnerability (yes, another one!) is a reminder that cyber threats are becoming more frequent and more serious.

Fortunately, at WHC, we have a dedicated team keeping a close eye on things. Their job? Monitor threats, identify risks, and act quickly to keep our clients protected.

That’s part of what hosting with WHC means: having a team looking out for your hosting, even when it’s the last thing on your mind.

Why your PHP version number might not have changed

If you’ve checked your PHP version since the news broke, you may have seen a number that looks older than the patched version in the headlines. On PHP 8.4, for example, your account might show 8.4.26 when the fixed release is 8.4.27. Reasonable to wonder if something was missed.

Nothing was missed. It comes down to how the fix reached our servers. It’s called backporting.

What backporting is

Think of a safety recall on a car. The manufacturer finds a defect, releases a newer model year with it fixed, and you assume you need the new one to be safe. You don’t. The shop installs the same corrected part into the car you already own. Your registration still reads the old model year. The defect is gone.

Backporting works the same way. When a security fix lands in a newer version of software, that fix can be lifted out and applied to the version you’re already running, without moving you to a new version number. Same version on paper. Vulnerability closed.

The important part: a new version number isn’t what makes you safe. The fix is. And the fix is in.

Why your account still shows the older number

Our hosting servers run on CloudLinux. When the PHP fix was released, CloudLinux applied it straight into its existing PHP packages instead of jumping to the brand-new version number. So the version you see in cPanel, phpinfo, or WordPress stayed the same, while the protection underneath it was added.

That’s why a patched server can still report 8.4.26. The version number alone doesn’t tell you whether you’re protected. The changelog does.

If you’re on one of our managed servers and you still see any of these versions, the fix is already applied:

• PHP 8.2.34
• PHP 8.3.35
• PHP 8.4.26
• PHP 8.5.11

Each one sits a step below the matching upstream PHP release on purpose. That gap is the backport, not a missing update.

Want the full technical detail? CloudLinux, the company behind the software on our servers, has published the complete breakdown of which packages were patched and how to confirm it. If you want to dig deeper, that’s the source of truth: CloudLinux’s PHP2Shell advisory.

What you need to do

If WHC manages your hosting, you’re protected and there’s nothing you need to do. The security patch has already been applied.

There are, however, a few situations that may need your attention.

If you manage your own server, or if our team doesn’t have access to it, we can’t apply the patch for you. We recommend doing so as soon as possible.

You’ll find instructions on the official PHP website.

Prefer to leave it to us? No problem! Just contact our team and provide access to your server. We’ll be happy to take care of it for you.

If you have root access and want to verify the fix yourself, remember the version number won’t tell you much here. Check the package changelog for the vulnerability IDs instead. On PHP 8.4, for example:

rpm -q ea-php84-php-cli --changelog | grep -E 'CVE-2026-(109618|109619)'

Swap ea-php84 for the package matching your PHP version. If the CVE IDs show up, the fix is applied.

What if your website runs a much older version of PHP?

If your site hasn’t been updated in years and still runs on a much older version of PHP (think PHP 7 or earlier), it’s possible the security patch could affect certain features or functionality.

Don’t worry, the vast majority of websites continue to work normally. But if you notice anything unusual, reach out to us. Our team is here to help.

We’re keeping watch

That’s it, folks! You don’t need to follow the technical details or refresh a news site all day. That’s our job.

If you have a question, or you’re not sure which category your setup falls into, our team is here. Reach us via your Client Area or chat with us on our website.