Navigation indicator

Security Update: All PHP versions patched against recent PHP vulnerabilities

October 21, 2026

Varial Hosting PHP Security

All PHP versions on our servers have been patched against the two critical security vulnerabilities disclosed today, CVE-2026-109618 and CVE-2026-109619.

Here is a brief summary of what happened and how we secured your hosting environment:

What Happened

PHP is the programming language that powers over 70% of the web, including popular applications like WordPress, Joomla, and Drupal. On October 20th, preliminary details of critical security vulnerabilities leaked ahead of schedule, prompting a rush by security researchers and bad actors to locate the flaw before fixed versions could be published. A proof-of-concept exploit tool named php2shell surfaced shortly after, demonstrating potential remote compromises of vulnerable PHP applications.

How We Protected Your Site

Our team worked continuously to monitor the situation and apply multiple layers of defense:

  • Preemptive Protection: Out of an abundance of caution, we temporarily took down our main website (varialhosting.com) and client portal on October 20th to display a maintenance page to protect customer data.
  • Immediate Mitigations: We applied protective PHP configuration changes across our servers and updated our Web Application Firewall (WAF) rules to block exploit patterns and scanning activity.
  • Backported Security Patches: To minimize the chance of unexpected complications or plugin incompatibilities that can occur with full version upgrades during an emergency, our security partner applied security patches directly to the PHP releases currently running on our servers (covering PHP 5.2 through 8.5). This ensures your environment receives the necessary protection without requiring a PHP version bump.

Current Status

  • All PHP Versions Patched: Every PHP version offered on our servers is protected against CVE-2026-109618 and CVE-2026-109619.
  • Services Fully Restored: Our website and client area are back online and functioning normally.
  • No Compromises Detected: We have observed no signs of security breaches on our network, a status confirmed by other hosting providers using our security partner’s protections.

Thank you for your patience while our team worked to safeguard your websites. If you have any questions, please feel free to reach out to our support team.

Every Update, Double-Checked: Introducing Visual Checks for WordPress Care

October 9, 2026

Updates keep your site safe. Occasionally, they also break it.

Every WordPress site runs on WordPress itself, a theme and a collection of plugins. Each one gets regular updates that fix security holes, squash bugs and keep everything compatible. Skipping them isn’t an option.

But every so often, an update changes something it shouldn’t. A section shifts out of place. A button disappears on phones. A contact form quietly stops sending. Too often, the first person to notice is a customer.

That’s why Varial Hosting’s WordPress Care plan has always tested every update on a private staging copy before it reaches your live site. Now we’ve added a new layer to that process: automated visual checks, using a tool we built in-house, that compare your site before and after every update.

Why “it looks fine” isn’t enough

The problems updates cause are rarely dramatic. They’re small and easy to miss:

  • A layout change that only appears on mobile
  • A page halfway down your menu that nobody thought to check
  • A script error that breaks a form or menu without changing how the page looks

Checking every important page, at every screen size, by eye alone is slow. And after the twentieth page, even a careful person starts to skim.

How we update your site now

Each week, your updates start on a private staging copy of your site, never on the live version. Here’s what happens:

  1. Before screenshots. Our tool captures full-page screenshots of your key pages, at both desktop and mobile sizes.
  2. Updates on staging. We update WordPress, your theme and your plugins on the staging copy.
  3. After screenshots. The tool captures the same pages again, the same way.
  4. Automatic comparison. Every page is compared pixel by pixel, and anything that changed is highlighted in red.
  5. Human review. We personally review every page the tool flags, side by side.
  6. Live update. Only once everything checks out do we back up your live site and apply the same updates.

We built this tool ourselves, specifically for the WordPress sites we look after. It runs on our own systems, so your screenshots and staging site details stay with us instead of being sent to a third-party service. And because it’s ours, we keep refining it as we learn how real WordPress sites behave.

The tool doesn’t replace our judgment. It points it at exactly the right places.

What the visual check catches

  • Layout changes: shifted sections, overlapping text, missing images or changed fonts, highlighted so we see exactly where.
  • Mobile-only problems: every page is checked at phone width too, where many update issues first appear.
  • Pages that stop working: a page that suddenly returns an error or fails to load.
  • Hidden errors: new JavaScript errors or missing files that can break forms, menus or checkout, even when the page looks identical.

What this means for you

  • Problems get caught on staging, before your visitors or customers ever see them.
  • Fewer surprises after update day, on desktop and mobile alike.
  • A visual record of your site. We keep screenshots from recent update cycles, so if something changes, we can see what it looked like before and when it changed.

You don’t need to do anything differently. Your site simply gets a more thorough check every time it’s updated.

Peace of mind, built in

Visual checks are now part of every Varial Hosting WordPress Care plan. If you’re already a Care client, they’re running on your site from your next weekly update.

Not a Care client yet? WordPress Care is $49/month per site, with no contracts. It also includes 24/7 monitoring, managed PHP upgrades and 30 minutes of webmaster help every month. Learn more about WordPress Care or contact us, and we’ll keep your WordPress site updated, secure and looking exactly the way it should.

PHP 8.5 Now Available

August 13, 2026

PHP 8.5 is now available to all Varial Hosting customers.

PHP 8.5 builds upon the great improvements brought forward in previous PHP 8 releases, and introduces several new features for developers which you can read about at: https://www.php.net/manual/en/migration85.php

To change your PHP version, simply log into your cPanel and follow this guide:
https://my.varialhosting.com/knowledgebase/98/How-do-I-change-PHP-versions.html

Please be aware that not all web applications and PHP extensions are compatible with PHP 8.5 at this time. For best compatibility we recommend using PHP 8.4 until development of PHP 8.5 matures.

Critical WordPress Core Vulnerability (wp2shell) – What You Need to Know

July 20, 2026

On July 17th, the WordPress Security Team released urgent patches for wp2shell, considered the worst security vulnerability in the WordPress core in nearly a decade.

Because this vulnerability exists in the WordPress application core—affecting hundreds of millions of sites across the global internet—we want to outline what took place, explain its impact and share the immediate steps we took across our infrastructure to keep your sites safe.

What Makes wp2shell So Serious?

  • Widespread Global Impact: This is a software vulnerability within the WordPress core codebase affecting hundreds of millions of websites worldwide.
  • No Extras Required: Unlike most security issues that target specific plugins or themes, this vulnerability exists directly in the main WordPress core software. It requires no plugins, no themes or even logged-in access to exploit.
  • Affected Versions: The vulnerability impacts WordPress core release branches 6.8, 6.9 and 7.0.
  • Immediate Threat: Automated exploit attempts began targeting vulnerable sites globally within hours of public disclosure on July 17th.

Actions We Have Already Taken

To protect client websites and maintain environment integrity, our team took immediate action upon the official patch release on July 17th:

  1. WordPress Care & Maintenance Subscribers: All client websites subscribed to our WordPress Care & Maintenance plan were audited and updated immediately.
  2. Installatron Automatic Updates: Sites configured with automatic core updates enabled in Installatron were automatically patched to safe versions that night.
  3. Web Application Firewall Protection: We deployed server-level firewall rules across our platform to intercept and block known exploit attempts.

What You Need to Do

While our active firewall rules block incoming attack attempts, updating your WordPress software to a patched release is the only permanent fix.

  • If your WordPress site is already updated to version 6.8.6, 6.9.5 or 7.0.2 (or higher):
    You are fully protected! No further action is required.
  • If your site is running a vulnerable version of the 6.8, 6.9 or 7.0 branch:
    Please update your site immediately. You can do this easily in one of two ways:
    • Option 1: Log in to your cPanel control panel, open Installatron, locate your WordPress site and click the update button.
    • Option 2: Log in directly to your WordPress Admin Dashboard (/wp-admin), navigate to Dashboard > Updates, and click Update Now.

If you have any questions or need assistance verifying whether your site is running a safe version, please open a support ticket with our technical support team—we are here to help!

Scheduled Maintenance: MariaDB Database Upgrades [Completed]

June 18, 2026

Varial Hosting Scheduled Maintenance

In the evening of Friday, June 26, 2026, we will be performing a major database engine upgrade on our Chang, Diggory, Flitwick, Lovegood and Tonks servers. The database software will be updated from MariaDB 10.6 to MariaDB 10.11 (LTS).

This upgrade ensures your applications continue to run on a highly secure, optimized and long-term supported database environment.

What to Expect:

  • Downtime: Websites utilizing MariaDB/MySQL databases on these specific servers will be temporarily unavailable for approximately 10 to 15 minutes while the upgrade process finishes.
  • Impact: Visitors accessing database-driven websites during this short window may encounter a database connection error. Static pages that do not use a database will remain fully functional.

Technical Notes & Changes:

MariaDB 10.11 is a major Long-Term Support release that introduces performance optimizations, advanced features like dynamic InnoDB variables and enhanced query optimizer telemetry.

While the upgrade is designed to be fully backward-compatible for standard website architectures (such as WordPress), advanced developers can review the official MariaDB 10.6 to 10.11 Upgrade Guide for a comprehensive breakdown of changed parameter defaults and performance adjustments.

We appreciate your patience and understanding as we work to improve our hosting infrastructure. If you have any questions or experience unexpected issues following the window, please open a ticket with our support team.