Security patches have now been deployed across all sites in our hosting environment, including those that required migration to updated infrastructure.
We are moving this incident to Monitoring as we continue verifying stability following the rollout. The previously reported WP-CLI issues have also been addressed.
To date, we have not identified any confirmed cases of compromise related to PHP2Shell in our hosting environment. This does not rule out previously undetected activity.
We will continue monitoring for related issues and provide a further update once verification is complete. If you encounter errors or need confirmation of your website’s patch status, please contact support.
Posted Oct 22, 2026 - 13:50 UTC
Update
As of 11:33 CEST on 22 October, work continues to address the small number of sites still awaiting security patches. We are preparing migrations to updated infrastructure where needed. These remaining updates are not yet complete.
A fix has also been applied for the discrepancy between the PHP versions used by WP-CLI and the web server. We have verified the correction on the previously reported example. If you continue to see an older PHP version in WP-CLI or encounter errors in the Templ Panel, please contact support.
Security patches remain deployed across nearly all of our hosting environment. We will provide another update as the remaining work progresses.
Posted Oct 22, 2026 - 09:36 UTC
Update
As of 09:55 CEST on 22 October, security patches for PHP 7.4 and newer have been deployed across nearly all of our hosting environment. A small number of sites still require additional work, and we are assessing migration to newer infrastructure where appropriate.
The previously reported WP-CLI issues have been reported as resolved. If you continue to encounter errors when using WP-CLI or performing actions in the Templ Panel, please contact support.
Please note that WP-CLI and your website may use different PHP installations. The version shown by WP-CLI therefore does not necessarily reflect the PHP version serving your website.
For PHP 8.2–8.4, the patched releases are:
- PHP 8.2.35 - PHP 8.3.36 - PHP 8.4.27
For PHP 7.4–8.1, our patched builds may retain existing PHP version numbers, so the version number alone is not sufficient to confirm patch status.
If you need confirmation for your website, please contact support with the website address and the email address associated with your Templ account.
We will provide further updates as the remaining work progresses.
Posted Oct 22, 2026 - 07:59 UTC
Update
Security patches for PHP 7.4 and newer have now been deployed across nearly all of our hosting environment.
A small number of sites remain unpatched and require additional work. We are assessing the best approach to complete these updates, including moving affected sites to newer infrastructure.
We are also investigating reports of WP-CLI failures following the updates. These may prevent the Templ Panel from interacting correctly with WordPress, causing errors when performing certain actions in the panel. Command-line WordPress management may also be affected.
Completing the remaining security updates and resolving the WP-CLI issues are our priorities. We will provide another update as this work progresses.
Posted Oct 22, 2026 - 06:44 UTC
Update
As of 23:35 CEST on 21 October, security patches have been deployed for PHP 8.2 and newer across our hosting environment, as well as for many sites running PHP 7.4–8.1.
Fewer than 100 sites running PHP 7.4–8.1 are still awaiting patches. Completing these updates remains our priority, and we are working to address them as soon as possible.
For sites still awaiting patches, our previous guidance remains unchanged: consider upgrading to PHP 8.2 or newer after checking compatibility, or temporarily enabling password protection if the site does not need to remain publicly accessible. Password protection is not a substitute for security patches.
We will provide another update as the remaining patching progresses.
Posted Oct 21, 2026 - 21:47 UTC
Update
As of 20:54 CEST on 21 October, the rollout of security patches for PHP 8.2 and newer continues across our hosting environment. Deployment is progressing, but may continue overnight. We cannot yet confirm a completion time.
We have also built patched packages for PHP 7.4, 8.0 and 8.1 for part of our server environment and are preparing to include these in the rollout. This does not yet mean that sites running these versions have been patched.
Our recommendation to move sites running PHP 8.1 or older to a newer, supported PHP version remains unchanged, with compatibility checks before switching.
As an additional precaution while patching continues, you can temporarily enable password protection through the Templ Panel, particularly for staging or non-public sites. This restricts access to visitors with the credentials and may interrupt integrations such as payment callbacks and webhooks. It is not a substitute for security patches.
We will continue to share updates as deployment and verification progress.
Posted Oct 21, 2026 - 18:58 UTC
Update
As of 18:26 CEST on 21 October, we have begun rolling out the patched PHP packages, updating servers individually and verifying the installations as we proceed. This is a gradual process, and we cannot yet confirm a completion time.
The PHP project’s release of security fixes does not mean ready-to-install packages are immediately available through every package provider. The released source code first needs to be compiled and packaged for the systems running it.
We prepared our own patched packages while awaiting availability through our usual provider. Deployment is underway but is not yet complete.
We will share further updates as the rollout progresses. Our previous customer guidance remains unchanged.
Posted Oct 21, 2026 - 16:45 UTC
Update
As of 17:24 CEST on 21 October, we have built patched releases for PHP 8.2, 8.3 and 8.4. We are now preparing a package repository to support deployment across our servers.
Building these packages is a preparation step; it does not mean they have been deployed to customer sites. We will provide another update as deployment progresses.
Our previous customer guidance remains unchanged.
Posted Oct 21, 2026 - 15:40 UTC
Identified
The required security fixes have been identified. Testing and preparations for deployment are ongoing, as described in our previous update.
Posted Oct 21, 2026 - 15:07 UTC
Update
The PHP security fixes have now been released, and we are testing patched builds and preparing for deployment.
At 16:37 CEST on 21 October, we deployed PHP 8.2.35 to a server hosting test sites only. Initial results are encouraging, but testing is still ongoing.
We also initiated PHP updates on servers in Sweden that use our package provider’s updates. At 16:40 CEST, checks showed that the provider was still supplying PHP 8.2.34 rather than the patched release. We therefore cannot yet confirm patch deployment on those servers.
The precautionary configuration change mentioned previously has now been applied to all sites. This can reduce exposure to certain attack paths, but does not provide complete protection. Security patches remain necessary.
We will share further updates as testing and deployment progress, including any expected service impact.
Posted Oct 21, 2026 - 14:57 UTC
Update
We are continuing preparations for the PHP security updates. This includes evaluating an alternative deployment approach for systems that require additional preparation, alongside options for sites running older PHP versions. We cannot yet confirm the rollout timing.
The precautionary configuration change mentioned in our previous update remains in progress. This change may reduce exposure, but its effectiveness against these vulnerabilities has not been confirmed. It is not a substitute for security patches.
Our customer guidance remains unchanged:
- PHP 8.1 or older: We recommend upgrading to PHP 8.2 or newer through the Templ Panel after checking your site’s compatibility. Moving to a newer PHP version does not by itself mean these vulnerabilities have been patched. - PHP 8.2 or newer: Templ will handle the security patch updates; no customer action is required at this stage.
We will share further details about the rollout and any expected service impact once confirmed.
Posted Oct 21, 2026 - 13:04 UTC
Update
We are preparing to apply the PHP security patches as soon as they become available. In the meantime, we are working on a precautionary configuration change that may reduce exposure. This is not a substitute for the security patches.
We do not currently expect downtime from patching. However, PHP services may need to restart, which could interrupt individual requests in progress.
Our customer guidance remains unchanged:
- PHP 8.1 or older: We recommend upgrading to PHP 8.2 or newer through the Templ Panel after checking your site’s compatibility. - PHP 8.2 or newer: Templ will handle the security patch updates; no customer action is required at this stage.
We are also investigating additional options to protect sites running PHP 8.1 or older. We have not yet confirmed an effective mitigation or the availability of patches for these versions.
We will provide another update when we have confirmed patch availability and our rollout plan.
Posted Oct 21, 2026 - 09:53 UTC
Investigating
We are reviewing the reported PHP security vulnerabilities known as PHP2Shell and preparing our response. We are assessing what these vulnerabilities mean for sites hosted on Templ and whether any planned measures could affect availability.
What you should do:
- PHP 8.1 or older: We recommend upgrading to PHP 8.2 or newer through the Templ Panel, checking your site’s compatibility before switching. Security fixes for older PHP versions may not be available. - PHP 8.2 or newer: No action is required from you at this stage. Templ handles PHP security patch updates for these versions.
Upgrading to PHP 8.2 or newer does not, by itself, mean these vulnerabilities have been patched.
We will share more information shortly about our planned measures and any expected service impact.