On October 20, 2026, details of two critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) became publicly available ahead of their scheduled disclosure.

All PHP versions available on our hosting platform have now been patched against both vulnerabilities.

We have deployed the official security updates for PHP 8.2 and newer (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), as well as security patches for older PHP versions, including legacy releases.

All updates have been applied server-wide, and no action is required from customers to address these specific vulnerabilities.

Enabling access to XML-RPC

Public access to the XML-RPC file (xmlrpc.php) on our servers is blocked by default, because the file is a common target for hackers. More details are available in our Error "412 Precondition Failed" (mod_security2) article. You can now easily enable access to it by following these steps:

1. Open the WordPress Manager in the hosting Control Panel.

2. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation.

3. Scroll down to the Security section, and locate the option called Enable access to XML-RPC.

4. Click on the Enable toggle next to it. WordPress XML-RPC access This is it - you can now successfully install and use any plugin that requires access to XML-RPC.