What’s Kinsta’s expected timeline regarding this security release?
I’m also curious about the current situation report.
I am currently 75th in the Kinsta online chat support queue, you might think Kinsta would broadcast an update for all customers considering the volume of enquiries they seem to be handling
116th in line, so please update us when you get a reply! 
Hey there,
Thanks for reaching out about this, and for keeping an eye on security! We’re aware of the upcoming PHP security release announced by the PHP security team, and our engineering and security teams are actively monitoring it.
Since PHP is managed at the platform level on Kinsta, there’s nothing you need to do on your end. We’ll roll out the fixes across our infrastructure as soon as they’re available and we’ve validated them, and we’ll share updates if anything changes that affects your sites.
Here’s where we stand:
- We’re rolling out a temporary configuration change across our infrastructure to reduce exposure. It doesn’t affect normal site operations.
- Additional Cloudflare protections are already helping block suspicious traffic.
- We’re ready to deploy patched PHP versions as soon as they’re released and validated.
In the meantime, keeping WordPress core, themes and plugins up to date is always a great step. Let us know if you have any other questions!
Kind regards,
If there is a link to any public statement from Kinsta on this and how they intend to handle the fix, would be great to post that here in the original post on top 
Here’s the latest update I received from our Kinsta Support Engineer:
Thanks for reaching out about this, and for keeping an eye on security! We’re aware of the upcoming PHP security release announced by the PHP security team, and our engineering and security teams are actively monitoring it.
Since PHP is managed at the platform level on Kinsta, there’s nothing you need to do on your end to apply these updates. We’ve already started rolling out interim mitigations, and we’re prepared to deploy the security fixes across our infrastructure once they’re available and have been validated. We’ll also share updates if anything changes that could affect your sites.
Here’s where we stand:
- We’re rolling out a temporary configuration change across our infrastructure to reduce exposure. It doesn’t affect normal site operations.
- Additional Cloudflare protections are already helping block suspicious traffic.
- We’re ready to deploy patched PHP versions as soon as they’re released and validated.
Thanks for the update @ryan-seit
Crazy that they have not made any official announcement yet.
The update is live here are the details https://www.php.net/
I think its truly poor that Kinsta does not have a status page for this issue…
Nearly all websites in The Netherlands are down, it’s a massive thing here. What do I communicate with my clients, knowing Kinsta doesn’t seem to care not even half as much as they do?
Hello everyone 
We were providing updates via chat, as you noted above. What @ryan-seit shared is what we had as public information.
The patch is still not applied, but our engineering team is working on that. Due to security concerns, we aren’t sharing any additional details but we are aware of the issue and working on it.
Kind regards,
Vladimir M | Support Lead EMEA
Could you please release a public message when the update has been rolled out?
Would highly appreciate that, even just an ongoing update that it’s still being worked on. Getting a bit antsy refreshing phpinfo pages!
Security angle of not publishing whether the sites are vulnerable or not is a little moot when it’s already publicly acknowledged so surely transparency is the best route here?
You should have posted official announcements on your news/blog section, your status page, and security banners when logging in to the admin panel.
That you have not done so is crazy to me. For example, you should look at the announcement from Laravel for inspiration: https://laravel.com/blog/php-critical-vulnerability-response-updates
Why has there been no public communication about this? Nothing in the dashboard, nothing on the blog, nothing on the status page. Really disappointing.
It’s great how we all get to continue serving our sites on unpatched versions of PHP. Please, take your time. 
I’m really surprised that a company like Kinsta fails to provide an updated status on what could potentially be largest vulnerability ever…
I assume you guys will update this post once changes are applied?
Get its a stressful day for you folks, I just want to make sure I am on top of public progress and statuses.
Upgrades now appear to be propagating, some but not all of our clients are showing patched versions. Thanks Kinsta team, I’m breathing a seriously large sigh of relief right now.
Update: PHP 8.5 patch is live on Kinsta, other versions still in progress
For anyone still waiting: I confirmed with Kinsta support via chat that the patched release is currently being rolled out for PHP 8.5 only. Patches for the other PHP versions are still being worked on.
8.5.12 contains the patch:
Quickest way to get patched right now
- In MyKinsta, switch the environment to PHP 8.5 (check plugin and theme compatibility first, ideally on staging).
- Connect via SSH and run
php -v. - You should see PHP 8.5.12, built Oct 21 2026. On my site it switched from 8.2.30 to 8.5.12 within a few checks.
Note: the php.net archive only lists the minor version (8.5), not the full patch number, so php -v is the reliable way to verify.
Don’t suspend your environments
If you suspended sites to take them offline, they won’t receive the patch. Suspending stops the whole container, not just the web side, so Kinsta can’t apply the update.
Kinsta support recommends this instead if you want your sites offline in the meantime:
- Kinsta already added new firewall rules this morning, so taking sites offline may not be necessary.
- If you still want to, add a Bot protection exception, set it to Path, Block, and use
/. - This blocks all traffic to the site while still allowing Kinsta to push the update. The rule can take up to 5 minutes to propagate.
Hope this helps others in the queue.