Two critical security vulnerabilities have recently been identified in PHP, a widely used programming language that powers millions of websites around the world, including popular platforms such as WordPress.
These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could potentially allow unauthorised access to affected web hosting environments.
What is 1st Domains doing?
At 1st Domains, the security of our customers' websites and data is a top priority.
Our technical team is actively responding to these vulnerabilities, reviewing our hosting infrastructure, implementing appropriate security mitigations, and deploying the latest PHP security patches as they become available.
We are prioritising this work to minimise potential exposure while maintaining the stability and availability of our hosting services.
We will continue to monitor developments closely and take further action as necessary.
Do customers need to take any action?
For customers using our shared web hosting services, our team is managing security updates to the underlying hosting infrastructure.
We strongly encourage customers to follow good website security practices, including:
- Ensure website applications are using latest versions of PHP 7.4 or above. Refer to our guide on setting the PHP version of your website.
- Keeping website software, such as WordPress, and any installed plugins and themes up to date.
- Ensuring website applications are compatible with currently supported PHP versions.
- Reviewing and maintaining regular website backups.
Customers managing their own VPS or server environments should review their PHP installations and apply the latest security updates as a priority.
Keeping you informed
We understand how important the security and reliability of your website is to your business.
Our team is treating these vulnerabilities seriously and working to ensure our hosting environments remain protected.
We will provide further updates if there are any significant developments that may affect our customers.