10/22/2026
To any of our customers on our hosting or if your a customer that we have referred to Hostinger.
Please make note
You weren't affected by the new PHP vulnerability
You might have seen news of a new PHP vulnerability. We tested it against our live servers and found it can’t be used to take over websites hosted with us, including WordPress sites.
Here's why your site(s) are safe:
Our shared hosting runs on LiteSpeed, which handles requests differently than the attack expects, so the malicious trigger never fires
On our newer platform, the vulnerable PHP feature is turned off
Each website runs under its own limited account, so even a successful attack couldn't reach the server or other customers' websites
PHP has since released a security fix. Even though our platform wasn't affected, we applied the fix across all hosting on October 21, 2026 as an extra layer of protection. The update is now complete.
You didn't need to do anything – we applied it automatically. If anything on your site(s) behaves differently now that the update is done, just let us know.
Have questions? Just reply to this email – our Customer Success team is here to help.