{"id":900724,"date":"2026-10-20T23:14:45","date_gmt":"2026-10-21T03:14:45","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/?p=900724"},"modified":"2026-10-22T15:28:17","modified_gmt":"2026-10-22T19:28:17","slug":"php-critical-security-release-october-2026","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/","title":{"rendered":"Critical PHP Security Release October 21, 2026: What InMotion Hosting Is Doing"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The PHP project shipped a critical PHP security release on Wednesday, October 21, 2026. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two flaws that allow remote code execution without a login. InMotion Hosting had already turned off the PHP setting the known exploit uses, on every server it manages. The patched PHP builds are installed on Shared, Reseller, WordPress Hosting, Dedicated, and UltraStack ONE servers. Most VPS are updated, and the CWP rollout is under way. You do not need to do anything for the protection already in place. You should still check that your site runs PHP 8.2 or newer, because older branches get no fix from PHP.<\/p>\n\n\n\n<p class=\"alert alert-info wp-block-paragraph\"><strong>Update, October 22, 2026:<\/strong> PHP has published the fixes and the Common Vulnerabilities and Exposures (CVE) details. This article covers the release, the protection InMotion Hosting applied on October 20, and the patch status by hosting platform as of October 22. Deployment status changes through the day, so <strong>check the <a href=\"https:\/\/status.inmotionhosting.com\/incidents\/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a\">InMotion Hosting status page<\/a> for the latest<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What We Know About the PHP Security Release<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Confirmed by PHP<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PHP&#8217;s <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\">security advisory<\/a> names the two flaws. <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-109618\">CVE-2026-109618<\/a> is remote code execution through out-of-memory corruption. <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-109619\">CVE-2026-109619<\/a> is remote code execution through stale global state. Both are rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. An attacker does not need an account to use them. The security community calls the pair &#8220;php2shell,&#8221; and a public exploit appeared before the patch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PHP has also confirmed the link to session upload progress. That means the precaution InMotion Hosting applied on October 20, described below, targets the real exploit path. PHP says updating is still the only complete fix. Turning off <code>session.upload_progress.enabled<\/code> blocks the known attack paths for the second flaw. It does not block every possible variant. The setting must change in <code>php.ini<\/code> or the PHP-FPM pool. A <code>.user.ini<\/code> file or an <code>ini_set()<\/code> call applies too late in the request to help.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which PHP Versions Get a Fix<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Which old branches get a fix depends on who built the PHP. PHP itself fixed only 8.2 through 8.5. cPanel has published backported fixes for <code>ea-php<\/code> 7.4, 8.0, and 8.1. CloudLinux has published fixes for every <code>alt-php<\/code> (PHP Selector) version. <strong>PHP 7.3 and older on a cPanel server without CloudLinux will not receive a fix<\/strong>. If your site runs one of those, upgrade the PHP version. Shared, Reseller, and WordPress Hosting servers run CloudLinux, so every PHP version in their PHP Selector gets a patched build. CloudLinux and cPanel applied the fix to the builds they already shipped instead of moving to PHP&#8217;s new version numbers. A patched server can still report PHP 8.3.35 rather than 8.3.36. The package changelog names both CVEs, and the <a href=\"https:\/\/cloudlinux.statuspage.io\/incidents\/zl0vt1yq3dj5\">CloudLinux incident page<\/a> shows how to check it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two more cases: TuxCare has released patched packages for all of its Extended Lifecycle Support systems. Control Web Panel (CWP) compiles PHP from source. CWP 1.21, released on October 22, adds the fixed PHP versions, and InMotion Hosting is rolling it out to every CWP server now. Any PHP version with no vendor fix stays protected only by the setting change described below. PHP 8.2 itself reaches end of life on December 31, 2026, so 8.3 or newer is the better target for an upgrade.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does My PHP Version Get a Fix?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This table shows which versions receive a patched build and which never will. It does not show whether the patch is installed on your server yet. For that, see the deployment status below and the status page.<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th>Where your PHP comes from<\/th><th>Gets a fix<\/th><th>No fix<\/th><\/tr><\/thead><tbody><tr><td>Shared, Reseller, and WordPress Hosting (CloudLinux PHP Selector)<\/td><td>Every version, 5.2 through 8.5<\/td><td>None<\/td><\/tr><tr><td>VPS and Dedicated Servers with cPanel<\/td><td>7.4 through 8.5<\/td><td>7.3 and older<\/td><\/tr><tr><td>VPS and Dedicated Servers with CloudLinux<\/td><td>Every PHP Selector version<\/td><td>None<\/td><\/tr><tr><td>Control Web Panel (CWP)<\/td><td>8.2, 8.3, and 8.4<\/td><td>7.4, 8.0, and 8.1<\/td><\/tr><tr><td>UltraStack ONE on AlmaLinux 9<\/td><td>8.2, 8.3, 8.4, and 8.5<\/td><td>None<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What InMotion Hosting Is Doing<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Protection Applied Before the Patch<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/status.inmotionhosting.com\/incidents\/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a\">Between the evening of October 20 and the early morning of October 21<\/a>, InMotion Hosting turned off the PHP <code>session.upload_progress.enabled<\/code> setting for every PHP version on every server it manages, then restarted PHP so the change took effect in memory. That work is complete on all Shared, Reseller, WordPress Hosting, VPS, Dedicated, UltraStack ONE, and CWP servers. PHP&#8217;s advisory now recommends this exact change for anyone who cannot update at once.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On October 21, InMotion Hosting also applied the second setting PHP recommends for CVE-2026-109619. On every server that runs PHP 8.5, it turned off <code>fatal_error_backtraces<\/code>, which is on by default in that version, and restarted PHP. PHP says this blocks the confirmed fatal backtrace path on PHP 8.5. That work is complete on VPS, Dedicated, UltraStack ONE, and CWP servers. Shared, Reseller, and WordPress Hosting servers do not offer PHP 8.5, so nothing changes there. The only visible effect is that fatal error messages on PHP 8.5 no longer include a backtrace until the patched build is in place.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On servers with the Imunify360 web application firewall, an updated ModSecurity rule set also blocks the public exploit pattern. CloudLinux describes that rule set as an interim measure, not a complete fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All of these measures are precautions. They block the known attack paths. Only the patched PHP build removes the flaws, which is why patching continues.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deployment Status by Server Type<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">InMotion Hosting deploys the patched packages as each vendor publishes them. Here is where each server type stands as of October 22, 2026:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dedicated servers:<\/strong> patched. The updated PHP packages, including the backports for 7.4, 8.0, and 8.1, are applied.<\/li>\n\n\n\n<li><strong>VPS:<\/strong> most servers are patched. The remaining servers pick up the packages as each one&#8217;s nightly update runs, and InMotion Hosting is pushing the update to any that do not.<\/li>\n\n\n\n<li><strong>Shared, Reseller, and WordPress Hosting:<\/strong> patched. These servers run CloudLinux, so the PHP versions you choose come from CloudLinux. CloudLinux published its fixed builds on October 21 and InMotion Hosting finished installing them on every shared server overnight. The PHP version number you see does not change, because CloudLinux patched the existing builds in place.<\/li>\n\n\n\n<li><strong>UltraStack ONE on AlmaLinux 9:<\/strong> patched. The Remi repository published the fixed PHP builds on the evening of October 21 and InMotion Hosting has installed them.<\/li>\n\n\n\n<li><strong>CWP servers:<\/strong> updates in progress. CWP released version 1.21 on October 22 with support for the fixed PHP builds. InMotion Hosting is updating CWP to 1.21 on every CWP server, then rebuilding PHP. Dedicated servers go first and VPS follow. Because the CWP panel itself runs on PHP, InMotion Hosting restricted the CWP and CWP Admin ports on the evening of October 21 as an added safeguard, and new VPS are now provisioned with those ports closed. You can still reach CWP if your IP address is allowed in the server firewall. Contact InMotion Hosting support to add yours. Webmail ports stay open. The restriction stays in place until InMotion Hosting&#8217;s engineers confirm it is safe to lift, because the panel&#8217;s own copy of PHP is still an older version. CWP has said it plans to update it but has not given a date.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/status.inmotionhosting.com\/incidents\/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a\">InMotion Hosting status page<\/a> carries live progress for each environment, so check it rather than this snapshot. InMotion Hosting tracks every server, not a sample. Automated checks confirm the setting change and the installed PHP version on each server, and they run again after every vendor update.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who the Setting Change Affects<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The setting only controls upload progress tracking. WordPress, Joomla, Drupal, Magento, PrestaShop, and other common platforms do not use it and are not affected. A custom PHP application that builds a progress bar from <code>$_SESSION<\/code> and the <code>PHP_SESSION_UPLOAD_PROGRESS<\/code> field will stop reporting progress. The upload itself still completes. On Shared, Reseller, and WordPress Hosting the setting is locked at the server level. A per-site override does not take effect. If your application depends on it, contact InMotion Hosting support.<\/p>\n\n\n\n<p class=\"alert alert-warning wp-block-paragraph\"><strong>Important:<\/strong> Both settings stay off on every platform for now, even where the patched PHP build is installed. Do not turn <code>session.upload_progress.enabled<\/code> or <code>fatal_error_backtraces<\/code> back on in a <code>.user.ini<\/code>, <code>php.ini<\/code>, or <code>.htaccess<\/code> file. InMotion Hosting will update this article when that changes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What You Should Do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Shared, Reseller, and WordPress Hosting:<\/strong> nothing is required. The patched PHP builds are installed, and they cover every PHP version you can select. The version number shown in cPanel does not change, so do not read an older number as an unpatched server. Still, <a href=\"https:\/\/www.inmotionhosting.com\/support\/website\/how-to-view-your-php-version-in-cpanel\/\">check your PHP version<\/a>. If you run 8.1 or older, <a href=\"https:\/\/www.inmotionhosting.com\/support\/website\/how-to-change-the-php-version-your-account-uses\/\">move to PHP 8.2 or newer<\/a> and test your site first. Those branches are end of life, and this is the last kind of fix they can expect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Managed VPS and Dedicated Servers:<\/strong> InMotion Hosting applies the patched packages for you. Follow the status page for your environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CWP servers:<\/strong> if you cannot open CWP or CWP Admin, the port restriction above is the reason. Contact InMotion Hosting support to allow your IP address in the firewall. Your websites and webmail keep working.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Self-managed VPS and Dedicated Servers with root access:<\/strong> on cPanel, run the EasyApache 4 updates in WHM, then restart Apache and PHP-FPM so the new build is live. On other systems, update PHP with your package manager and restart the PHP workers. If you cannot update yet, PHP recommends setting <code>session.upload_progress.enabled=0<\/code> in <code>php.ini<\/code> or the PHP-FPM pool and restarting PHP. If you must stay on an end-of-life PHP version, InMotion Hosting offers <a href=\"https:\/\/www.inmotionhosting.com\/support\/edu\/whm\/tuxcare-php-extended-lifecycle-support\/\">TuxCare PHP Extended Lifecycle Support<\/a> for patched legacy PHP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you believe your site was compromised, contact InMotion Hosting support. The guide <a href=\"https:\/\/www.inmotionhosting.com\/support\/security\/does-your-site-have-malware\/\">Does Your Site Have Malware?<\/a> explains how to check.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Comes Next<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">InMotion Hosting will update this article when the VPS and CWP rollouts complete, when the CWP port restriction lifts, and when the two precautionary settings are turned back on. The <a href=\"https:\/\/status.inmotionhosting.com\/incidents\/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a\">status page<\/a> carries live progress by environment. Official release notes are in the <a href=\"https:\/\/www.php.net\/archive\/2026.php\">PHP news archive<\/a>.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>The PHP project shipped a critical PHP security release on Wednesday, October 21, 2026. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two flaws that allow remote code execution without a login. InMotion Hosting had already turned off the PHP setting the known exploit uses, on every server it manages. The patched PHP builds are installed<a class=\"moretag\" href=\"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/\"> Read More ><\/a><\/p>\n","protected":false},"author":57032,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_ayudawp_aiss_exclude":false,"_ayudawp_aiss_exclude_summary":false,"_ayudawp_aiss_summary":"Between the evening of October 20 and the early morning of October 21, InMotion Hosting turned off the PHP setting for every PHP version on every server it manages, then restarted PHP so the change took effect in memory. If you cannot update yet, PHP recommends setting in or the PHP-FPM pool and restarting PHP. If you must stay on an end-of-life PHP version, InMotion Hosting offers TuxCare PHP Extended Lifecycle Support for patched legacy PHP.","_ayudawp_aiss_summary_provider":"extractive","_ayudawp_aiss_summary_hash":"1e8e73057501e315d0a012fc83300a9f3412e049","_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4300],"tags":[],"class_list":["post-900724","post","type-post","status-publish","format-standard","hentry","category-news"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PHP Security Release: Critical Patch Out October 21<\/title>\n<meta name=\"description\" content=\"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PHP Security Release: Critical Patch Out October 21\" \/>\n<meta property=\"og:description\" content=\"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T03:14:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T19:28:17+00:00\" \/>\n<meta name=\"author\" content=\"Derrell\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Derrell\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/\"},\"author\":{\"name\":\"Derrell\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#\\\/schema\\\/person\\\/0736f70b4077032374f89709cdc255b7\"},\"headline\":\"Critical PHP Security Release October 21, 2026: What InMotion Hosting Is Doing\",\"datePublished\":\"2026-10-21T03:14:45+00:00\",\"dateModified\":\"2026-10-22T19:28:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/\"},\"wordCount\":1599,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#organization\"},\"articleSection\":[\"News \\\/ Announcements\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/\",\"url\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/\",\"name\":\"PHP Security Release: Critical Patch Out October 21\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#website\"},\"datePublished\":\"2026-10-21T03:14:45+00:00\",\"dateModified\":\"2026-10-22T19:28:17+00:00\",\"description\":\"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/news\\\/php-critical-security-release-october-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Critical PHP Security Release October 21, 2026: What InMotion Hosting Is Doing\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#website\",\"url\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support &amp; Tutorials\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/inmotionhosting\\\/\",\"https:\\\/\\\/x.com\\\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/#\\\/schema\\\/person\\\/0736f70b4077032374f89709cdc255b7\",\"name\":\"Derrell\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/derrell-willis\"],\"url\":\"https:\\\/\\\/www.inmotionhosting.com\\\/support\\\/author\\\/derrellw\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PHP Security Release: Critical Patch Out October 21","description":"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/","og_locale":"en_US","og_type":"article","og_title":"PHP Security Release: Critical Patch Out October 21","og_description":"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.","og_url":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2026-10-21T03:14:45+00:00","article_modified_time":"2026-10-22T19:28:17+00:00","author":"Derrell","twitter_card":"summary_large_image","twitter_creator":"@InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"Derrell","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/"},"author":{"name":"Derrell","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/0736f70b4077032374f89709cdc255b7"},"headline":"Critical PHP Security Release October 21, 2026: What InMotion Hosting Is Doing","datePublished":"2026-10-21T03:14:45+00:00","dateModified":"2026-10-22T19:28:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/"},"wordCount":1599,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["News \/ Announcements"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/","url":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/","name":"PHP Security Release: Critical Patch Out October 21","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2026-10-21T03:14:45+00:00","dateModified":"2026-10-22T19:28:17+00:00","description":"PHP released fixes for two critical flaws on October 21, 2026. See what InMotion Hosting has already done and what you should do.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/news\/php-critical-security-release-october-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Critical PHP Security Release October 21, 2026: What InMotion Hosting Is Doing"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support &amp; Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/0736f70b4077032374f89709cdc255b7","name":"Derrell","sameAs":["https:\/\/www.linkedin.com\/in\/derrell-willis"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/derrellw\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","primary_category":{"id":4300,"name":"News \/ Announcements","slug":"news","link":"https:\/\/www.inmotionhosting.com\/support\/news\/"},"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/900724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57032"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=900724"}],"version-history":[{"count":11,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/900724\/revisions"}],"predecessor-version":[{"id":900749,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/900724\/revisions\/900749"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=900724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=900724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=900724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}