Skip to content

Security update: All Skyrack servers are running patched PHP versions, protecting client sites against CVE-2026-109618 and CVE-2026-109619.

PHP security update: your questions answered

Are Skyrack servers protected?

Yes. All Skyrack servers run CloudLinux and are running the latest patched PHP packages, protecting client sites against the two critical PHP vulnerabilities announced on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619).

Why does my site show an older PHP version number?

The PHP project fixed the vulnerabilities in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our servers use CloudLinux’s PHP builds, which carry the same fix as a backport and keep their own, lower version numbers.

For example, CloudLinux’s patched PHP 8.4 reports 8.4.26 rather than 8.4.27. A lower number does not mean your site is vulnerable.

What is backporting?

Backporting means taking a security fix from a newer release and applying it to the version already installed. The vulnerable code is fixed, but the version number stays the same. It is standard practice for enterprise Linux vendors, including CloudLinux, Red Hat and Debian.

What about older PHP versions, like 7.4 or 8.1?

The PHP project does not release updates for PHP 8.1 and older. CloudLinux provides patched builds of older PHP versions through its Hardened PHP service, so sites on those versions are covered too.

My security scanner says my PHP version is vulnerable

Many scanners judge only by the version number, so they cannot see backported fixes and report a false positive. The reliable check is the package changelog, which lists the CVE IDs that have been fixed. If you need confirmation for an audit or a client, open a support ticket.

My site is showing a WordPress or PHP error

Some sites were affected by the updates we applied across hosting accounts. Open a support ticket with your site address and our team will resolve it.

Further reading

Skyrack

Performance

Speed comes from the stack, not from a plugin. LiteSpeed with server-level caching, Enterprise SSD storage and low-contention servers in a Sydney data centre.

How we build for speed

Four things decide how fast a site feels

The web server, the storage under it, how many accounts share the machine, and how far the machine is from the person loading the page. Get those right and a normal WordPress site is quick without heroics. Get them wrong and no amount of optimisation inside the site will rescue it. Here is what we run, and why each part of it matters.

LiteSpeed web server

We run LiteSpeed rather than a stock Apache setup. It handles concurrent connections far more efficiently, which is what keeps a site steady when a campaign, a newsletter or a mention sends everyone at once.

Server-level caching

Caching happens at the server, not just inside WordPress. A cached page is served straight out of the cache without waking PHP or touching the database, so repeat visitors get an immediate response.

Enterprise SSD storage

All accounts sit on Enterprise SSD storage. Database queries, plugin file reads and media delivery all come off solid state hardware built for sustained server workloads rather than desktop use.

HTTP/3

Modern browsers connect over HTTP/3, which sets up faster and handles packet loss better than what came before. It shows up most on mobile connections, where the loss is real.

Low-contention servers

We deliberately limit how many accounts go on each server. Fewer neighbours means more of the machine is available to your site, and one busy account cannot flatten everyone else on the box.

Hosted in Sydney

Your site is hosted in a Sydney data centre and your domain resolves against DNS nodes in Perth, Adelaide, Melbourne and Sydney. For an Australian audience that removes latency you cannot optimise away.

Distance matters

Why an Australian server wins for an Australian audience

Where we host your website

Loading a page takes several round trips before any content appears: the DNS lookup, the connection, the TLS handshake, then the HTML, then every asset the HTML references. Each round trip costs the time it takes to reach the server and come back.

That cost is set by physical distance and it applies to every visitor, every time. A server on the other side of the Pacific starts each page behind, and the deficit is repeated for every asset on it.

Hosting in Sydney and answering DNS from around the country removes that overhead for the people most Australian sites are actually built for. It is the cheapest performance improvement available, and it happens before your site does any work at all.

Your part

What you can do on top of the stack

The server does the heavy lifting, but a few choices inside the site make a visible difference on top of it.

  • Install and enable the LiteSpeed Cache plugin. It is what connects WordPress to our server-level cache, and it does far more than a generic caching plugin can on our stack.
  • Optimise your images. Resize them to the dimensions they are displayed at, serve modern formats, and let the plugin handle lazy loading below the fold.
  • Run one caching plugin, not three. Stacking page caches on top of each other causes conflicts and usually makes a site slower.
  • Audit your plugins occasionally. Deactivating what you no longer use removes queries and scripts from every single page load.
  • Keep WordPress, themes and plugins current through WP Toolkit. Newer releases are generally faster as well as safer.
  • Use staging before you change anything significant, so a performance regression is caught before your visitors find it.
Performance FAQ

Questions we get asked

Do I need a caching plugin if the server already caches?

Yes, use LiteSpeed Cache. The server-level cache does the work, and the plugin is how WordPress tells it what to cache and when to clear it, for example after you publish a post or someone adds to a cart. Without the plugin the cache cannot tell a stale page from a fresh one. On WordPress plans we set this up during migration.

What does "low contention" actually mean?

It means we cap how many hosting accounts we place on each server, well below what the hardware could technically hold. Shared hosting is only ever as fast as what is left over after your neighbours, so limiting the number of neighbours is the most direct way to protect your resources. It is also why we are not the cheapest option on the market.

Will moving to Skyrack make my slow site fast?

It will remove the hosting from the list of causes, which is often the largest single item. LiteSpeed, Enterprise SSD storage and a Sydney location fix the parts you cannot fix from inside WordPress. What we cannot fix for you is a page loading forty plugins or a two megabyte hero image. Migration is free and has no downtime, so trying it costs you nothing: see how migrations work.

Put your site on the fast stack

WordPress hosting from $4.98/month on LiteSpeed and Enterprise SSD, with free migration and hourly backups.

See WordPress hosting plans