PHP security update: what Clear clients need to know

Following news of two critical security flaws in PHP, all servers managed directly by Clear have been updated with the official security fixes. We’re not aware of any client site being affected.

Here’s a brief overview of the issue and the action we’ve taken.

What has happened?

On 21 October 2026, the PHP project released fixes for two critical security vulnerabilities. PHP is the programming language behind platforms including WordPress and Magento, and most of the websites we support.

The flaws could allow an attacker to run code on an unpatched web server. Because they affect PHP itself, the issue has implications for websites worldwide.

What has Clear done?

Our technical team had been tracking the issue ahead of the public announcement. We applied temporary protections on the afternoon of 21 October, then installed the official fixes that evening and overnight, as soon as our software vendors made them available.

All servers we manage are now fully patched, and we’ve checked that websites are running normally following the updates.

For websites hosted with partners such as Corefinity, Kualo, Sonassi and Cloudways, the hosting companies are responsible for applying the fixes. We’ve already verified that several are patched and are confirming the remaining sites.

Not a Clear client? Here’s what to do

If your website is managed elsewhere, check with your hosting provider or development team that the official PHP security fixes have been applied.

1. Confirm your server is patched. Ask your host or developer to confirm that your website’s PHP environment has received the relevant security update.
2. Apply the fixes promptly. If you manage your own server, install the official security release for your supported PHP version.
3. Check your website afterwards. Test key functions, including forms, checkout and logins, to make sure everything is working normally.

If you’re unsure where to start, get in touch with Clear and we can help you understand what needs checking.

Do you need to do anything?

No action is needed from Clear clients at this stage. We’re continuing our checks with hosting partners and will contact you directly if anything needs your attention.

If you have any questions about your website or hosting, speak to your usual Clear contact.