No error shown on the page, but the live page proves this server is running vulnerable PHP 8.4.25.
Other Information
Hello Support Team,
I hope this message finds you well.
I am a user of InfinityFree hosting and I am running a WordPress site. Recently, I read security advisories regarding critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that affect versions below 8.4.27.
To verify the environment, I created the simple test page provided in the URL above. As you can see on the page, the current server is running PHP 8.4.25, which falls within the affected range.
Since users cannot manually change the PHP version in the control panel, I wanted to kindly ask if the team is aware of this and if there are any plans to upgrade the server environment to PHP 8.4.27 or higher to ensure the security of our sites.
Thank you very much for your time and for providing this free service. I look forward to your reply.
Welcome to the InfinityFree community forum! Good to have you here.
Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
I can’t answer this one: whether the servers move to PHP 8.4.27 or later is up to InfinityFree staff, and I couldn’t find anything on the forum about patch-level updates or those CVEs. I can’t verify the advisory either, so I’m not confirming that 8.4.25 is affected. A person needs to have a look.
The closest thing I found is the announcement that all free hosting servers were moved to PHP 8.4 by staff, not by users:
It says nothing about minor or security releases after that.
iFastNet needs to handle this. Because they compile their own PHP it’ll probably lag behind for a while which is indeed a bad thing. Unfortunately there’s not much we can do.
Hello, my domain fyk.free.nf (account IF0_41892663) is running on a PHP version affected by the critical unauthenticated RCE vulnerabilities published on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.4.27/8.3.36/8.2.35). Has my account’s hosting server already received this patch? Thank you for your clarification.
Securing the servers is iFastNet’s responsibility. The servers appear to be running PHP 8.4.25 right now, which could be vulnerable. However, it’s possible that iFastNet implemented other mitigations to keep websites secure.
But I too am curious what their plans actually are, so I’ve sent them a message asking for clarification on this.