Metal2 Hosting Platform Update
Following recent industry attention surrounding PHP security vulnerabilities, we have completed a review of the Metal2 hosting platform and taken the opportunity to verify both security and performance-related components across the server environment.
Upgrades timestamped 23 October 2026 include:
- PHP security patches verified and current for PHP 8.2 and 8.4
- PHP 8.4 adopted as the platform default for new accounts
- PHP 8.2 retained for compatibility requirements
- OPcache enabled across supported PHP branches
- PHP 8.5 available for evaluation and early adoption
- HTTP/2 and HTTP/3 options under review as part of ongoing platform development
Current WHM release: WHM 138.0.18
Click open the headers below to learn more. Be sure to contact us for general advice if you are in doubt. Changes made apply to web server architecture and are apart from individual hosting accounts which remain the responsibility of end users unless support is contracted.
PHP Security Patching and PHP versions
Our server estate is fully up to date with the latest supported PHP security releases. Our servers currently support:
- PHP 8.2.35
- PHP 8.4.27
While our libraries support other PHP versions, these are our recommended because they include the latest security updates and protections currently available for their respective branches.
Our review, prompted by worldwide news commentary about PHP vulnerabilities, confirmed that these updates had already been applied through the cPanel/EasyApache update process before the recent media coverage of PHP vulnerabilities became widespread. No emergency remediation was required.
We continue to maintain PHP 8.2 as a compatibility option for websites that depend on older applications, ionCube-encoded software, or other legacy components.
PHP 8.5 is also installed and available for testing and early adoption purposes. While it is available for individual websites, we currently regard PHP 8.5 as an early-adopter platform rather than a recommended production standard until the wider WordPress ecosystem has had further time to mature around it.
PHP 8.4 Now the Default for New Hosting Accounts
Following our review, PHP 8.4 has been designated as the default PHP version for new hosting accounts and virtual hosts.
This decision reflects the maturity of the PHP 8.4 branch within:
- cPanel & WHM
- EasyApache 4
- WordPress
- Mainstream plugin and theme ecosystems
Websites already operating correctly on PHP 8.2 will not be automatically migrated and can continue to use that branch where appropriate.
Our current PHP strategy is therefore:
- PHP 8.2 – Compatibility and legacy application support
- PHP 8.4 – Recommended default platform
- PHP 8.5 – Optional early-adopter platform
OPcache Deployment
As part of the review withing this web server changelog, we identified an opportunity to improve PHP performance across the server environment. We have installed OPcache for PHP 8.2 and 8.4. OPcache operates a little differently under PHP 8.5 and this is also operational.
What is OPcache?
Every time a PHP page is requested, PHP normally has to:
- Read the script from disk
- Parse the code
- Compile it into executable bytecode
- Execute it
OPcache stores the compiled bytecode in memory so that these compilation steps do not need to be repeated for every request.
For WordPress websites this typically results in:
- Faster page generation
- Reduced CPU utilisation
- Lower server load
- Improved responsiveness during periods of higher traffic
Current Status
As of this web server changelog, the following OPcache deployments have now been confirmed:
- PHP 8.2 – OPcache installed and enabled
- PHP 8.4 – OPcache installed and enabled
- PHP 8.5 – OPcache already present and enabled within the installed package set
This enhancement benefits all WordPress-based websites hosted on the platform without requiring any changes to individual sites. You can read more about OPcache here.
HTTP Protocol Review (Ongoing)
We have not amended HTTP processes within the upgrades covered in this web server changelog. However, as part of the wider audit, we also reviewed how web traffic is delivered by the server.
Modern websites can operate using several versions of the HTTP protocol:
- HTTP/1.1 – Traditional protocol, widely supported
- HTTP/2 – Improved efficiency and parallel asset delivery
- HTTP/3 – Latest generation protocol using QUIC transport technology
The current server configuration is operating reliably under HTTP/1.1. We have also identified a possible pathway to enabling HTTP/2 support through Apache, however this requires changes to the underlying Apache processing model.
Unlike routine PHP updates, this is an architectural change that warrants careful evaluation and testing before deployment on a production hosting environment.
For that reason, no HTTP-related changes have been implemented at this time. We are continuing to assess:
- Potential performance benefits
- Compatibility implications
- Recommended cPanel deployment practices
- Migration requirements
Any future changes to the HTTP stack will be announced separately once testing has been completed.
Summary
Upgrades timestamped 23 October 2026 include:
- PHP security patches verified and current for PHP 8.2 and 8.4
- PHP 8.4 adopted as the platform default for new accounts
- PHP 8.2 retained for compatibility requirements
- OPcache enabled across supported PHP branches
- PHP 8.5 available for evaluation and early adoption
- HTTP/2 and HTTP/3 options under review as part of ongoing platform development
Current WHM release: WHM 138.0.18
About ComStat.uk: Internet Service Provider Comstat provides IT support, web hosting, and media services including website design, Microsoft 365 setup, and audio/video production, serving businesses across Denbighshire, North Wales and Wirral from Ruthin, and Lancashire and the Northwest from Bolton.
