Updated on the morning of Friday 23 October 2026 with the latest hosting company statuses.
On 21 October 2026 the PHP project released an emergency security update fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can let an attacker run code on a web server without logging in. WordPress runs on PHP, so WordPress.org published a Critical PHP Security Release notice the same day asking site owners to make sure PHP is updated.
It is serious. Cloudflare’s chief executive, Matthew Prince, reported thousands of exploit attempts before the announcement and millions by the following day. For most site owners, though, the work sits with the hosting company, and by Friday 23 October most of the large hosts had finished patching.
What has happened
The flaws are in PHP itself, the software on the server that runs WordPress. Plugins, themes and WordPress core are not the cause, and updating WordPress does not fix it. WordPress.org has confirmed that no WordPress update is required or planned.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official security updates, so sites on those versions need to move to 8.2 or newer.
If you’re on managed or shared hosting
Your host runs PHP for you and is responsible for updating it. By the morning of Friday 23 October, most of the large hosts had finished:
- WP Engine marked its rollout complete early on 22 October, covering PHP 7.4, 8.2, 8.4 and 8.5.
- Cloudways reported every active server patched on the morning of 22 October, including older PHP versions back to 5.6.
- DreamHost confirmed the update was applied across its whole network on 22 October.
- Pantheon has patched every live site on PHP 8.2 to 8.5. Pressable and SiteGround said their sites were protected from the start.
- Kinsta was still rolling out patched PHP version by version and emails account users when each site is done.
- Liquid Web was still deploying in stages on the evening of 22 October.
cPanel and Plesk have also released updated PHP packages, so the many smaller shared hosts that use those panels can apply the fix. Codeable keeps a longer list of hosting company statements if yours isn’t covered here.
If you’re with a reputable managed host, you don’t need to change anything.
How to check without waiting on a support queue
Every host’s support team is getting the same question this week, so a ticket may take a while to get a useful answer. Most of what you need is available without one.
- Find your PHP version. In your WordPress dashboard go to Tools, Site Health, then the Info tab, and open the Server section. Your hosting control panel usually shows it too.
- If it says 8.1 or lower, you need an upgrade regardless of this week’s fix. See the section on older versions below.
- Check your host’s status page, blog or recent emails. Most hosts are posting updates there. Search for your host’s name with “PHP security” if you can’t find it.
- Don’t rely on the version number alone. Many servers install PHP from their Linux distribution, which applies the fix without changing the version number shown. A version number lower than the ones listed above can still be patched.
Contact support only if your host still hasn’t said anything publicly, or if you’re on PHP 8.1 or older and can’t change it yourself. Keep the question short and specific: “Has the 21 October PHP security release been applied to the server hosting example.com?” is easier to answer than a general request about security.
If you manage your own server
This is the group that needs to act. If your site runs on a VPS or cloud server (DigitalOcean, Hetzner, AWS, Linode and similar), whether set up by hand or through a tool such as Forge, Ploi or RunCloud, nobody else will patch PHP for you.
- Install the updated PHP packages from your package source and restart PHP-FPM or Apache so every process runs the fixed version.
- Check where your PHP comes from. Ubuntu’s own packages, Ondřej Surý’s packages (sury.org), AlmaLinux and Red Hat have all released fixed PHP. The Remi repository was slower to ship, so if your server uses it, confirm the installed version before assuming you’re patched.
- If the site is behind Cloudflare, Cloudflare has added firewall rules for these attacks on all plans, including free. Treat this as extra protection while you patch. Cloudflare still advises updating PHP.
If your site runs PHP 8.1 or older
The PHP project only patches 8.2 and newer. Some hosts and long-term support vendors are backporting fixes to older versions, so check with your host before assuming the worst. If you run your own server on an old version and can’t upgrade straight away, both WordPress.org and the UK National Cyber Security Centre suggest considering taking the site offline until you can.
Older themes and plugins can break on newer PHP, so test the upgrade on a staging copy first where possible, and take a full backup before changing the live site.
What to do now
Check your PHP version in Site Health and look at your host’s status page. On managed hosting, that is usually all you need to do. If you manage your own server, update PHP today and restart it. If you’re on 8.1 or older, plan the upgrade now. It is also worth making sure WordPress itself is current, as covered in our post on the WordPress 7.1.2 security update.
Author
