What Infomaniak did on October 21
On its status page, Infomaniak opened a maintenance window at 3 PM titled « Critical PHP Vulnerabilities, » scheduled until October 22 at 3 AM. The opening message: mitigation measures and fixes were deployed by their teams, and no action was required from clients, except migrating a site still running an unsupported PHP version. Hour by hour: at 4:29 PM, phpMyAdmin went into maintenance; at 4:53 PM, the function involved in one of the two vulnerabilities, session.upload_progress, was disabled across the entire platform, freezing the progress bar for some file uploads without preventing the upload; at 5:04 PM, deployment of fixed versions for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5 began; at 9:09 PM, deployment was still ongoing; at 11:21 PM, ongoing infrastructure migrations were paused to avoid disrupting the operation. A second notice, at 5:20 PM, temporarily limited file uploads on kSuite, SwissTransfer, and ticketing.
The notable point: Infomaniak announced fixes for 7.4, 8.0, and 8.1, branches for which the PHP project no longer releases updates. These are backported fixes by their teams. It’s genuine protection, but it applies only to this host, and their own message still recommends upgrading.
Where to check and change the PHP version in the Manager
In the Infomaniak Manager, open the hosting and site management, click on the name of the relevant site, then on More information. In the PHP section, click on Edit, select the version, then Save. The setting is per site, and the change takes effect immediately.
Two key details to note. First, Infomaniak prevents reverting to an older version once the change is made: test on a backup first if your site is outdated, as you won’t be able to undo it with a single click. Second, for long-standing hosting, the Manager may require updating the hosting itself before offering newer PHP versions: a banner indicates this if applicable, and tonight, this update may be paused while the fixes are deployed.
Which version to choose
PHP 8.3 or 8.4: the safe choice for WordPress, WooCommerce, or a newer tool. The patched versions are 8.3.36 and 8.4.27, with security fixes until 2027 and 2028.
PHP 8.2: patched up to 8.2.35, but the branch ends on December 31, 2026.
PHP 8.1, 8.0, 7.4: at Infomaniak, these branches receive a custom patch for this vulnerability, which is not the case with most hosting providers. This gives you time to properly prepare the version upgrade, without postponing it until next year: these branches no longer have official fixes for subsequent vulnerabilities. Check that your theme and plugins support the target version, then upgrade.
Check that the patch is properly installed
The Manager displays the branch. The exact patch number can be read on a phpinfo page or, on WordPress, in Tools, then Site Health, tab Info, section Server. For branches 8.2 to 8.5, the numbers to look for are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For 7.4, 8.0, and 8.1, the patch backported by Infomaniak may not always change the displayed number: the status page and a written response from support are what matter. The verification tool reads the number when the server displays it and reflects the hosting provider’s status.
If the site breaks after the change
Since rolling back is blocked at Infomaniak, extra caution is advised: back up outside the server, test on a site copy, update the theme and plugins before upgrading. A blank page or a 500 error right after almost always comes from an incompatible plugin or a removed function between branches, and the PHP error log of the site, accessible in the Manager, will tell you which one.
And if you don’t want to handle it yourself
I’ll perform this intervention remotely: backup, testing on a copy, updating plugins, version change, patch verification, testing the homepage, administration, and a payment, followed by a written report. Write to me with your site’s link, I’ll respond within 24 hours. The same guides apply for OVHcloud, o2switch, IONOS, Hostinger and PlanetHoster.
Sources: Infomaniak guide ‘Changing the PHP version of a site’, Infomaniak status page, maintenance ‘Critical PHP vulnerabilities’ from October 21, 2026, corrected versions on php.net.
