When a serious security flaw is found in PHP, such as PHP2Shell in October 2026, we patch PHP on all of our cPanel web hosting and reseller servers for you. This guide explains what we do, what you might see afterwards, and what's still up to you.
Do I need to do anything to get the patch?
On our cPanel web hosting and reseller hosting: no. PHP is installed and updated on the server by us, so you can't patch it from inside cPanel and you don't need to. Every PHP version we offer gets the fix, including the older ones.
For current security issues, check Support → Announcements (https://www.hooplahosting.co.nz/client/announcements). We post there once our servers are patched, so you don't need to open a ticket to ask.
On a Cloud VPS or dedicated server you manage yourself: you're responsible for updating PHP. Install your operating system's updates as soon as a fix is released, then restart your web server and PHP (for example PHP-FPM) so the new version is in use.
On a Managed cPanel VPS: we patch PHP for you. We need working root access to do it, so if you've changed your root password, update it with us using the sensitive data area on a ticket. See How to send logins and sensitive data to our team securely.
Why does my PHP version still look "vulnerable"?
Our servers run CloudLinux, which supplies our PHP builds. When a fix comes out, CloudLinux often adds it to the PHP version we already run (this is called a backport) instead of moving to the next version number.
So phpinfo(), WordPress Site Health, WP Toolkit or a security scanner may show a version that's one number lower than the PHP project's fixed release. For example, after PHP2Shell the PHP project released 8.3.36, while our patched build still shows 8.3.35.
Scanners usually judge by the version number alone, so they can report a site as vulnerable when it isn't. If our announcement says we're patched, your site is protected against that issue, whatever version number it shows.
Patched isn't the same as supported
A backported fix closes one specific hole. It doesn't make an old PHP version safe overall. PHP 8.1 and older no longer get regular security updates from the PHP project, and PHP 8.2 only gets security fixes until 31 December 2026.
We recommend PHP 8.3, 8.4 or 8.5. For the full list and support dates, see Which PHP versions do you support?
Set a PHP version for each site
Each site either uses a version you've chosen, or follows the server's default version. In an emergency we may need to change the server default, for example if a fix isn't yet available for the old default. Sites that follow the default then move to the new version automatically, while sites with their own version set aren't touched.
To avoid surprises, set a specific version for every site:
- Go to Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services), open your hosting service and click Log in to cPanel.
- Type PHP in the cPanel search bar and open MultiPHP Manager.
- Check the PHP Version column. A site showing Inherit follows the server default.
- Tick the site, choose a version from the PHP Version drop-down and click Apply.
For more detail, see Change your PHP version and settings.
Resellers: MultiPHP Manager isn't available in WHM on reseller plans, so set the version in each account's cPanel. In WHM, open List Accounts and click the cPanel icon next to an account to log in to it.
My site broke after a PHP change
Older themes, plugins and custom code sometimes don't work on newer PHP versions. You might see a blank page, "There has been a critical error on this website", or a single page that no longer loads.
- Get the site back up: in MultiPHP Manager, set the site back to the version it was using before and click Apply. This takes effect straight away.
- Find the cause: check your error log to see which plugin, theme or file failed. See Find and read your website error logs.
- Fix it: for WordPress, update WordPress, your theme and your plugins, and replace any that are no longer maintained. For custom code, ask your developer to update it for the newer version.
- Move up again: once it's fixed, switch the site to PHP 8.3 or newer and test the home page, a few inner pages, forms, checkout and the admin area.
Treat an old PHP version as a short-term fix only. A site left on an unsupported version is more likely to be hacked.
Can you change settings for all my sites?
You can change PHP settings for your own account in cPanel's MultiPHP INI Editor (choose Home Directory to apply them to every site in that account). Server-wide PHP settings are managed by us. If you're changing a setting because of a security issue, check our announcement first, as the fix may already be in place.
Need help?
If you're not sure which version your site needs, or something stopped working after a PHP change, open a support ticket from Support → Open Ticket. Include your domain name, the page that isn't working and what you're seeing, and we'll check the error logs with you.
