What IONOS said on October 21
On the evening of October 21, I found no public announcement from IONOS regarding these vulnerabilities, neither on its support page nor in the press, unlike o2switch, OVHcloud, or Infomaniak. This doesn’t mean nothing is being done: in shared hosting, IONOS itself installs new PHP versions on its servers for maintained branches. This means you must check for yourself, and the only reliable answer is from support, in writing: which PHP version is my site using, and is the October 21 patch installed?
Where to change the PHP version in the IONOS customer portal
Log in to your customer portal and select Hosting to open the overview of your web project. Locate the PHP section and click on Open. Check the box for the affected domain(s), then click on Modify PHP Version. Select the desired version and save. IONOS notes that the update « may take some time »: usually a few minutes, the time it takes for the setting to propagate.
The detail not to miss: at IONOS, the setting is per domain. If you have a showcase website and a store on two domains under the same contract, you must check both. A forgotten subdomain remains on the old version.
PHP Extended Support: what it is and what it does not guarantee
IONOS offers a service called PHP Extended Support: its own teams fix security vulnerabilities in PHP versions that the PHP project no longer maintains, such as 7.2 or 7.3, to allow old websites to continue running. The IONOS guide does not specify whether this service is charged: check your contract.
In the situation of October 21, two things to know. On the one hand, this support fixes vulnerabilities ‘after the fact,’ once IONOS has produced its own patch: nothing guarantees that your old version is protected on the same day. On the other hand, a site still running PHP 7.x or 8.0 in 2026 has a broader issue than just this vulnerability. The clean solution is to switch to a maintained branch. To cancel extended support, the process is the same: Hosting, PHP, Open, select the domain, choose a current version, Save, then click on the link Cancel PHP Extended Support in the following window.
Which version to choose
PHP 8.3 or 8.4: the safe choice for WordPress, WooCommerce, or a recent tool. The patched versions are 8.3.36 and 8.4.27, with security fixes until 2027 and 2028.
PHP 8.2: patched in 8.2.35, but the branch ends on December 31, 2026.
PHP 8.1 and older: No official corrected version exists. If your site is affected, upgrading isn’t just about comfort—it’s a security update. Before proceeding, check that your CMS, theme, and extensions support the target version: WordPress runs from 7.4 to 8.5, PrestaShop depends on its own version, and it’s almost always an outdated extension that causes the block.
Verify that the patch is properly installed
The client area menu displays the branch. The exact number appears on your site’s phpinfo page or, on WordPress, in Tools, then Site Health, tab Info, section Server. The numbers to look for are 8.2.35, 8.3.36, 8.4.27, or 8.5.12. If you see a lower number after selecting the correct branch, IONOS hasn’t yet received the update—that’s when a written request to support becomes meaningful. The verification tool reads the number once the server displays it.
If the site breaks after the upgrade
IONOS states it in its guide: back up the project beforehand, check the site afterward, and if something breaks, revert to the previous version using the same menu. Common errors after an upgrade have their own help page at IONOS, but in practice, it’s usually an outdated extension or theme, and the fix is to update or replace it before upgrading again.
And if you don’t want to handle it yourself
I perform this remotely: backup, testing on a copy, version change for each domain, patch verification, testing the homepage, admin panel, and a payment, followed by a written report. Send me your site’s link, and I’ll reply within 24 hours. The same guides apply for OVHcloud and o2switch.
Sources: IONOS guide « Update PHP version and cancel PHP Extended Support », hosting providers review by Clubic on October 21 at 6:25 PM, fixed versions on php.net.
