Skip to content

Security update: All Skyrack servers are running patched PHP versions, protecting client sites against CVE-2026-109618 and CVE-2026-109619.

PHP security update: your questions answered

Are Skyrack servers protected?

Yes. All Skyrack servers run CloudLinux and are running the latest patched PHP packages, protecting client sites against the two critical PHP vulnerabilities announced on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619).

Why does my site show an older PHP version number?

The PHP project fixed the vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our servers use CloudLinux’s PHP builds, which carry the same fix as a backport and keep their own, lower version numbers.

For example, CloudLinux’s patched PHP 8.4 reports 8.4.26 rather than 8.4.27. A lower number does not mean your site is vulnerable.

What is backporting?

Backporting means taking a security fix from a newer release and applying it to the version already installed. The vulnerable code is fixed, but the version number stays the same. It is standard practice for enterprise Linux vendors, including CloudLinux, Red Hat and Debian.

What about older PHP versions, like 7.4 or 8.1?

The PHP project does not release updates for PHP 8.1 and older. CloudLinux provides patched builds of older PHP versions through its Hardened PHP service, so sites on those versions are covered too.

My security scanner says my PHP version is vulnerable

Many scanners judge only by the version number, so they cannot see backported fixes and report a false positive. The reliable check is the package changelog, which lists the CVE IDs that have been fixed. If you need confirmation for an audit or a client, open a support ticket.

My site is showing a WordPress or PHP error

Some sites were affected by the updates we applied across hosting accounts. Open a support ticket with your site address and our team will resolve it.

Further reading

Australian data centres

Hosting servers in a Sydney data centre, DNS nodes from Perth to Sydney, and your data kept in Australia. Here is what sits behind your website.

Data centre FAQ

Questions we get asked

Where exactly is my website hosted?

Your hosting account lives on our servers in a Sydney data centre. The DNS that resolves your domain is answered from our nodes in Perth, Adelaide, Melbourne and Sydney. Everything stays within Australia.

Does my data stay in Australia?

Yes. Your website files, databases, email and backups are held in Australia. If you need to state where your data is stored for a tender, a policy document or a client agreement, you can say it is hosted onshore in Australia by an Australian owned and operated company.

What happens if there is a hardware failure?

The facility is built with redundant power, cooling and network paths so that a single failure does not take services offline, and we run hourly backups so account data can be restored quickly if it ever comes to that. Our plans carry a 99.9% uptime guarantee, and our Australian support team handles anything that does go wrong. See our service level agreement for the detail. Any incident, and its progress, is posted on our public status page.

Host where your visitors are

Australian servers, an Australian support team and free migration from your current host. No lock-in contracts.

See hosting plans