Important Security Announcement: End of Support for PHP 8.1 and Older
Why we are doing this
On 21 October 2026, two critical vulnerabilities known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619, severity 9.2/10) were disclosed in the PHP language itself. These flaws allow an attacker to take complete control of a website without needing any password or login, and exploitation attempts are already being observed in the wild.
Fixed versions exist only in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and every older version (8.0, 7.4, 7.3, 7.2 and earlier) are end-of-life and will never receive a security fix.
To protect all customers who share this hosting infrastructure, WebJi is enforcing a minimum PHP standard with immediate effect.
Our new PHP policy
- Minimum supported version: PHP 8.2.35 or later. Versions 8.2.35, 8.3.36 and 8.4.27 are available on our servers and are considered secure. We recommend 8.3 or 8.4 for the longest support life.
- PHP 8.1.x and older are no longer supported in any form. This is a security decision and cannot be overridden by a support request.
- Websites still running PHP below 8.2.35 will be either suspended / changed to latest php secure version - it is your responsibility to make your website code updated timely with the help of your developer. This step is necessary because one compromised website endangers every other customer on the same server or can even result in server hacking issues.
- Any hacking or defacement incident on a VPS or dedicated server caused by a website running PHP below 8.2.35 is excluded from complimentary support. Remediation / restore assistance will be charged at our standard administration rates, payable separately by the customer per hour basis for system admin time fee of our admin time is INR 3000 + 18% GST per hour.
- On shared hosting, older PHP would not be allowed for security reasons under any condition.
Security of your application code is your responsibility. If your website runs custom or third-party PHP code, it is your responsibility—preferably with your developer—to keep that code updated, compatible with current PHP versions, and free of vulnerabilities. WebJi provides and maintains the hosting platform, including secure PHP versions; the application running on it is yours.
What you must do now
- If your website uses PHP 8.1 or older, please complete these steps asap without any further delay:
- Take a full offsite backup of your website files and database.
- Engage your web developer to make your application compatible with PHP 8.2 or newer, and to update any outdated CMS, plugins, themes or frameworks.
- Switch your site to a supported version in Plesk: Domains → yourdomain.com → PHP Settings → select PHP 8.2, 8.3 or 8.4 (FPM) — then test your website thoroughly, including login and checkout pages.
- Verify the change: Plesk → Domains → PHP Settings should show PHP 8.2.x / 8.3.x / 8.4.x.
- If you are unsure which PHP version your site currently uses, check the same location (Domains → PHP Settings), or contact our support team and we will tell you at support@webji.services
Important limitation of liability
Any website compromise, hacking, defacement, malware infection, or data loss affecting a website running PHP below 8.2.35 is not the responsibility of WebJi. By continuing to operate on an unsupported PHP version after the deadline, the customer accepts full responsibility for all consequences, including suspension of service without refund as described in our Terms of Service.
We do not enjoy sending notices like these, but with active attacks already happening, this is the only responsible path. Customers who upgrade promptly should experience no interruption, and our support team is happy to answer questions about the process.
Please also understand that a hacked website can be misused for illegal activity such as phishing, malware and fraud — which creates serious legal consequences for both the customer and the hosting provider. Legally and ethically, we are therefore unable to host or support any website running PHP below 8.2.35. We regret the inconvenience, but this is necessary to keep everyone on our platform safe and secure.
Thank you for your cooperation in keeping your website — and our entire hosting community — secure.
For more details about that PHP security risk, please refer to our last announcement at https://billing.webji.in/announcements/430/Critical-PHP-Vulnerabilities-CVE-2026-109618-and-CVE-2026-109619-Date-28-October-2026--Priority-CRITICAL--Action-Required.html
Is there any other option my team require more time to update the php version?
Ans: As explained in this announcement, websites running vulnerable PHP versions are at risk of both website and server compromise. For that reason, we are unable to continue supporting them in their current state.
- Please download your backups, place an under-construction page on the website, and upload the site again only after the code has been updated.
- If your development team is comfortable with AI-assisted development, this should not require many days. How quickly it can be completed depends on how familiar your team is with current AI development tools.
- We can only host sites that meet the required minimum php version. All sites must run PHP 8.2.35, as previously stated. Leaving a server or website exposed to infection is not an acceptable option. This is a global issue.
https://www.google.com/search?q=php+vulberability+how+many+sites+at+risk&oq=php+vulberability+how+many+sites+at+risk&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIJCAEQIRgKGKABMgkIAhAhGAoYoAEyBwgDECEYjwIyBwgEECEYjwLSAQg4NjU2ajFqN6gCALACAA&sourceid=chrome&source=chrome.ob&ie=UTF-8
Roughly 70% to 75% of global websites and applications that are powered, or partly powered, by PHP are affected by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). That share of the web is therefore at risk of a website or server compromise.
Screenshot of google search link below:
