New PHP security vulnerability, protective measure on web hosting
Monitoring ·
The fixed PHP version is expected on 19 November 2026. Until then, the protective measure remains in place on our web hosting servers, and the only visible difference is still that some progress bars do not appear while uploading files.
We will install the fixed version as soon as it is released and will then remove this measure.
Show all 3 updatesHide history
Monitoring ·
The protective measure has been in place on all our web hosting servers since 19:40 (Paris time). No website was interrupted while it was being applied.
The only visible difference is still that some progress bars no longer appear while uploading files. Uploads work normally.
We will install the fixed PHP version as soon as it is released and will then remove this measure.
Identified ·
A new security vulnerability in PHP was announced on 23 October 2026 (CVE-2026-115560). No fix is available yet, the PHP team plans it for its next release.
Our checks found none of our servers exploitable as things stand. As a precaution, and as recommended by CERT-EU, we are now disabling the PHP feature involved on our web hosting servers, upload progress tracking (session.upload_progress).
For your websites, the only expected effect is that some progress bars may no longer appear while uploading files, for example in phpMyAdmin. The uploads themselves work normally. Websites may be slowed down for a few seconds while the measure is applied.
We will install the fixed PHP version as soon as it is released. This measure does not affect your VPS or game servers.
Marseille, France
New York, United States
Frankfurt, Germany
Amsterdam, Netherlands
Beauharnois, Canada
Sydney, Australia