Back to overview
Resolved

Upcoming critical PHP security update

Oct 21, 2026 at 1:14am UTC
Affected services
dreamithost.com.au
Client Portal
Helpdesk
web20.hosting-cloud.net:2087
web23.hosting-cloud.net:2087
web25.hosting-cloud.net:2087
web26.hosting-cloud.net:2087
web27.hosting-cloud.net:2087
web28.hosting-cloud.net:2087
web31.hosting-cloud.net:2087
web32.hosting-cloud.net:2087
web34.hosting-cloud.net:2087
web35.hosting-cloud.net:2087
web38.hosting-cloud.net:2087
web41.hosting-cloud.net:2087
web42.hosting-cloud.net:2087
web43.hosting-cloud.net:2087
web44.hosting-cloud.net:2087
web45.hosting-cloud.net:2087
web59.hosting-cloud.net:2087
web62.hosting-cloud.net:2087
web64.hosting-cloud.net:2087
web65.hosting-cloud.net:2087
web66.hosting-cloud.net:2087
web67.hosting-cloud.net:2087
web72.hosting-cloud.net:2087
web74.hosting-cloud.net:2087
web77.hosting-cloud.net:2087
web78.hosting-cloud.net:2087
web79.hosting-cloud.net:2087
web82.hosting-cloud.net:2087
web85.hosting-cloud.net:2087
web86.hosting-cloud.net:2087
web89.hosting-cloud.net:2087
web90.hosting-cloud.net:2087
web92.hosting-cloud.net:2087
web93.hosting-cloud.net:2087
web94.hosting-cloud.net:2087
web95.hosting-cloud.net:2087
web100.hosting-cloud.net:2087
web101.hosting-cloud.net:2087
web102.hosting-cloud.net:2087
web104.hosting-cloud.net:2087
web105.hosting-cloud.net:2087
web106.hosting-cloud.net:2087
web107.hosting-cloud.net:2087
web111.hosting-cloud.net:2087
web113.hosting-cloud.net:2087
web115.hosting-cloud.net:2087
web118.hosting-cloud.net:2087
web120.hosting-cloud.net:2087
web125.hosting-cloud.net:2087
web128.hosting-cloud.net:2087
web133.hosting-cloud.net:2087
web135.hosting-cloud.net:2087
web136.hosting-cloud.net:2087
web146.hosting-cloud.net:2087
web143.hosting-cloud.net:2087
email6.hosting-cloud.net:2222
email7.hosting-cloud.net:2087
cp47.hosting-cloud.net:2222
cp48.hosting-cloud.net:2222
cp49.hosting-cloud.net:2222
cp50.hosting-cloud.net:2222
cp51.hosting-cloud.net:2222
cp52.hosting-cloud.net:2222
cp53.hosting-cloud.net:2222
cp55.hosting-cloud.net:2222
cp56.hosting-cloud.net:2222
cp57.hosting-cloud.net:2222
cp60.hosting-cloud.net:2222
cp61.hosting-cloud.net:2222
cp68.hosting-cloud.net:2222
cp70.hosting-cloud.net:2222
cp71.hosting-cloud.net:2222
cp76.hosting-cloud.net:2222
cp80.hosting-cloud.net:2222
cp81.hosting-cloud.net:2222
cp83.hosting-cloud.net:2222
cp86.hosting-cloud.net:2222
cp88.hosting-cloud.net:2222
cp96.hosting-cloud.net:2222
cp97.hosting-cloud.net:2222
cp98.hosting-cloud.net:2222
cp103.hosting-cloud.net:2222
cp109.hosting-cloud.net:2222
cp110.hosting-cloud.net:2222
cp112.hosting-cloud.net:2222
cp114.hosting-cloud.net:2222
cp116.hosting-cloud.net:2222
cp117.hosting-cloud.net:2222
cp119.hosting-cloud.net:2222
cp121.hosting-cloud.net:2222
cp122.hosting-cloud.net:2222
cp123.hosting-cloud.net:2222
cp124.hosting-cloud.net:2222
cp126.hosting-cloud.net:2222
cp127.hosting-cloud.net:2222
cp130.hosting-cloud.net:2222
cp131.hosting-cloud.net:2222
cp134.hosting-cloud.net:2222
cp147.hosting-cloud.net:2222

Resolved
Oct 22, 2026 at 12:00am UTC

Thank you for your patience.

Our team is happy to advise that security patches for the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been completed and deployed across our hosting servers.

As a precaution to safeguard our clients' data and our network infrastructure, webmail was temporarily disabled while this work was carried out. Webmail has now been restored and is available as normal. Our website, Client Portal and support portal are also back online, so you can log in, place orders and pay invoices as usual.

Older PHP versions have also been patched. However, as best practice, we recommend updating your website to PHP 8.3 at a minimum. Older PHP versions have either reached end of life or will soon, and no longer receive regular security updates from the PHP project. Before you change versions, please check your website's compatibility and take a backup. Our guide explains how to change the PHP version in your control panel: https://help.dreamithost.com.au/knowledgebase/article/how-to-change-the-php-version

If you continue to have issues, please raise a support ticket with our Melbourne-based support team.

Thank you for your ongoing support and patience.

Updated
Oct 21, 2026 at 10:30pm UTC

Our team is now rolling out security patches across our hosting platform to address the critical PHP vulnerabilities.

During this time, some customers may experience degraded performance on hosted websites while servers are updated.

We are also applying patches to older PHP versions. However, we strongly recommend upgrading your website to a minimum of PHP 8.3. PHP 8.2 reaches end of life on 31 December 2026, and all earlier versions have already reached end of life and no longer receive security updates from the PHP project.

We recommend checking your website's compatibility and taking a backup before changing versions. If you're unsure how to do this, please reach out to our team or a web developer.
Please see our guide here on how to change the PHP version within your control panel: https://help.dreamithost.com.au/knowledgebase/article/how-to-change-the-php-version

Your data security remains our highest priority. We will continue to provide status updates as they become available.

Thank you for your understanding and patience.

Updated
Oct 21, 2026 at 9:59am UTC

As a further precaution, we have temporarily taken our website, Client Portal and support portal offline while our team applies important security updates.

Customers will not be able to log in to the Client Portal or support portal, place orders or pay invoices online during this time. Our Melbourne-based support team remains available via live chat on our website, or by email at hello@dreamit.au.

The Australian Cyber Security Centre has issued a critical alert about these PHP vulnerabilities: https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php

We apologise for any inconvenience and thank you for your patience.

Updated
Oct 21, 2026 at 4:32am UTC

Our Engineering team is preparing a rollout to disable the PHP extension related to the vulnerability.

The PHP extension session.upload_progress.enabled will be disabled globally as a precaution.

Created
Oct 21, 2026 at 1:14am UTC

The PHP security team has announced an upcoming security release that fixes two critical vulnerabilities in PHP. The release is scheduled for 1:00 am AEDT on Thursday, 22 October 2026.

Please refer to the announcement here: https://www.php.net/index.php#2026-10-20-1

Our team is preparing now so we can apply the updated PHP versions across our hosting platform as soon as they are available from our software vendors.

We will post further updates here as patching progresses.

Customers with unmanaged VPS or dedicated servers should plan to update PHP on their own servers as soon as the fixed versions are released.

Your data security remains our highest priority. Thank you for your understanding and patience. Should you have any questions, please reach out to our Melbourne-based support team.