PHP Security Vulnerability: Protections Are In Place

What to do

• Check whether your product depends on DreamHost. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-10-23 18:26 UTC and 2026-10-23 18:26 UTC may need a replay.

• Subscribe to DreamHost's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=dreamhost works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from DreamHost 1

1. resolvedOct 23, 2026, 6:26 PM UTC

   October 21, 2026 6:46AM PDT Monitoring - Our Operations team has implemented protections against the PHP remote code execution vulnerability across all our hosting platforms, including shared, VPS, DreamPress, and dedicated. These protections are active now, and we have not observed any attack traffic related to this issue to date. Patched PHP versions are being released today. Our Technical Operations team is ready to deploy updated PHP builds as soon as they are available. We'll share another update once the patched builds are available. October 21, 2026 9:04AM PDT Monitoring - We are currently rolling out PHP's upstream fix fleet-wide. Known attack vectors and confirmed exploit paths across all PHP versions remain closed. Additionally, our Web Application Firewall (WAF) is actively blocking any incoming exploit attempts. We will continue to monitor systems closely as the final upstream fixes finish deploying. The next update will be provided once the fleet-wide deployment is fully complete. October 21, 2026 12:55PM PDT Monitoring - We are continuing to roll out PHP updates across all servers and PHP versions. Our systems remain closely monitored as the final updates finish deploying, and we will share our next update once the deployment is complete. October 21, 2026 1:43PM PDT Monitoring - We're continuing to roll out PHP's official fix across all servers and expect it to be complete soon. Sites on PHP 8.1 and older are protected by the mitigations we deployed early, before the details were public. Security fixes for these versions, provided under our PHP Extended Support program, are being built and are expected to roll out within the next day. No action is needed on your end. We'll keep you posted and share another update as soon as the rollout is complete. October 21, 2026 10:59PM PDT Monitoring - We have successfully completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure. For our remaining environments, our Operations Team is currently staging packages and running final stability tests to ensure a smooth transition. The mitigations we deployed earlier remains enforced, keeping your sites secure while we complete this final phase. No action is required on your end. We will provide another update once the full rollout has concluded. October 22, 2026 4:24AM PDT Monitoring - The official PHP security updates have been applied across the bulk of our network. Operations is currently executing final staging tests and stability checks for the remaining server groups before completing the final deployment phase. All active threat mitigations implemented previously remain live, maintaining full coverage for your application environment. No intervention is needed on your end, and we will send out a notification upon final rollout completion. October 22, 2026 11:12AM PDT Monitoring - PHP Security Vulnerability: Protections Are In Place - The official PHP security updates have been applied across the entirety of our network. All active threat mitigations implemented previously remain live, maintaining full coverage for your application environment. No intervention is needed on your end. October 23, 2026 11:26AM PDT Resolved - PHP’s security fix is now installed across all DreamHost servers, including Shared, Dedicated, VPS, and DreamPress. Sites on PHP 8.1 and older are also covered under our PHP Extended Support program. Thank you for your patience.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.