Hi Michael, Earlier today the PHP project released security updates for every supported version of PHP. They fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow remote code execution on servers running PHP, including PHP-FPM, which is what your SpinupWP servers use. Because of the severity, we’ve taken the step of running an automatic PHP update on all SpinupWP servers running Ubuntu 22.04 or newer. On servers where patched packages were available, the update installed them for every version of PHP on the server and restarted PHP-FPM, which may have caused a brief interruption to requests on your sites. What you need to do For most customers, nothing. If the update failed on one of your servers, you’ll see an upgrade named Update PHP versions in that server’s dashboard. Please review the failed task and run the upgrade again. There are two exceptions: • ARM servers. Patched packages for ARM (arm64) servers haven’t been published yet. The update will have completed on these servers without installing anything, so they are not yet patched. We’re monitoring the package repository and will run the update again as soon as ARM packages are available. Until then, see the partial mitigations in our doc. They reduce exposure but don’t fully protect a server, as updating PHP is the only complete fix. • Ubuntu 20.04 servers. Our PHP package repository no longer provides updates for Ubuntu 20.04, so these servers can’t receive this fix through our update process. If you still have sites on an Ubuntu 20.04 server, we recommend moving them to a new server on a current Ubuntu release. Full details, including how to confirm a server is patched and the exact package versions to look for, are in our doc: https://spinupwp.com/doc/php-security-update/ If you have any questions, just reply to this email and we’ll be happy to help. Cheers,
George You're receiving this message as a user of SpinupWP. Our postal address is PO Box 363, Springfield, ON, Canada N0L 2J0.