Updated October 25, 2026
On October 21, 2026, the PHP project disclosed two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. PHP says these issues can permit unauthenticated remote code execution and strongly encourages updates.
If you run a WordPress site, this is a reason to check with your hosting provider promptly—not a reason to panic or change settings blindly. The issue affects PHP installations serving web requests and is not unique to WordPress. WordPress.org has said that no WordPress core update is required or planned specifically for these PHP vulnerabilities, but site owners should confirm that their host has addressed the PHP environment serving their site.
The important question is not simply, “Is WordPress updated?” It is: has the PHP runtime serving my website received the applicable security fix or a vendor backport?
Is this a WordPress update?
Not exactly. A WordPress website relies on several separate layers that need their own maintenance:
- WordPress core is the website application.
- Themes and plugins add design, features and integrations.
- PHP is the server-side programming runtime WordPress uses to process requests.
- Your hosting platform provides and maintains the server environment where that PHP runtime operates.
Updating WordPress core, themes or plugins is still important, but it does not by itself confirm that a server-side PHP security patch has been applied. Likewise, changing the PHP version selected in cPanel or another hosting dashboard is not automatically the right response to a security advisory. A production PHP version change can affect compatibility and should be planned and tested.
Advantage Hosting customers : Your PHP security updates have been applied.
Advantage Hosting has completed deployment of the applicable October 21, 2026 PHP security updates across our maintained hosting PHP environments. We have verified that our installed PHP packages include the fixes for CVE-2026-109618 and CVE-2026-109619, including CloudLinux security backports for older PHP versions. These patches were applied at the server level, so Advantage Hosting customers do not need to update WordPress or change their PHP version specifically to receive these fixes. We continue to monitor PHP security updates and recommend keeping WordPress, themes and plugins maintained and compatible.
Three things to do today
1. Find your site’s reported PHP version
In the WordPress dashboard, go to Tools → Site Health → Info → Server. Look for the PHP version reported for the site. Your hosting dashboard may also show the selected PHP version for the account or domain.
Record what you find, but do not treat the displayed version alone as final proof of patch status.
2. Check your host’s status notice or ask support
Look for a current security notice from your hosting provider. If there is no clear notice, open a support request and ask whether the PHP packages serving your account have received fixes or a vendor backport for both CVEs.
You can copy and paste this message:
“Can you confirm whether the PHP environment serving my domain has received the fixes or a vendor backport for CVE-2026-109618 and CVE-2026-109619? If a backport was used, can you confirm my account is covered even if its displayed PHP branch did not change?”
3. Confirm the answer applies to your website’s active PHP handler
A useful response should address the PHP environment that actually serves your website, not only a host’s internal administrative software or a general platform statement. This matters on shared, reseller and multi-account hosting environments where accounts can use different PHP handlers or package builds.
Ask for written confirmation if the answer is unclear. On shared hosting, customers generally should not attempt server-level verification commands themselves.
Why the PHP version you see may not tell the whole story
The PHP project published fixed upstream versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those version numbers are useful reference points, but hosting environments may package security fixes differently.
Hosting platforms can backport a security patch while retaining an existing displayed PHP branch or version number. For example, cPanel has documented fixes and backports across EasyApache PHP versions, and CloudLinux has noted that some fixed alt-PHP and ea-PHP builds can retain their existing version number.
That means a version screen can start the conversation, but it cannot always finish it. Your host is the right party to confirm whether the PHP package and handler serving your account are covered.
Do not make these mistakes
- Do not assume a WordPress core update resolves a PHP server vulnerability. These are separate layers of the stack.
- Do not switch a production PHP selector without testing. A newer PHP version can expose compatibility issues in older themes, plugins or custom code.
- Do not treat a WAF rule as a substitute for patching. Protective rules may be useful as an interim measure, but the PHP environment still needs the appropriate security update.
- Do not ignore an unsupported PHP version because the site still loads. WordPress.org notes that PHP versions before 8.2 are no longer supported upstream. That does not automatically mean an individual hosting account is unpatched, because a provider may have deployed a backport—but it is a good reason to plan an upgrade path.
After the urgent check: plan a safe PHP compatibility review
Once you have confirmation about the immediate PHP advisory, turn the moment into a practical maintenance task. A planned PHP upgrade is different from an emergency patch check: it should be staged, tested and reversible.
- Make sure you have a verified backup and a realistic restore path.
- Update WordPress core, themes and plugins where appropriate.
- Review compatibility notes for important plugins, custom code and integrations.
- Test on a staging environment before changing PHP on a production site, where possible.
- After a planned change, test key pages and workflows: contact forms, logins, password resets, checkout and payment steps, scheduled tasks, and transactional email such as WooCommerce receipts.
- Confirm the site still responds normally after maintenance and that no unintended access or indexing settings were changed.
For a broader workflow covering backups, staging and recovery discipline, see Advantage Hosting’s guide, How to Update WordPress Safely: A Security Checklist for Canadian Business Websites. If email delivery is part of your testing plan, our article Why WordPress Emails Go Missing can help you review common delivery issues.
When to ask for help before changing PHP
Ask for technical assistance before making a production PHP change if your site has WooCommerce, custom themes or plugins, legacy code, payment integrations, a large client portfolio, or an unclear response from your provider. These sites may need a compatibility review and staged testing rather than a quick setting change.
Not sure whether your PHP environment is patched or whether a PHP change is safe for your site? Contact Advantage Hosting for help reviewing your WordPress hosting environment. Moving from another provider? Ask about a managed WordPress migration.
Frequently asked questions
Do I need to update PHP for my WordPress site?
First, confirm with your host that the PHP runtime serving your site has received fixes or a vendor backport for CVE-2026-109618 and CVE-2026-109619. Do not change the PHP version in production solely because of an alert without considering compatibility and testing.
How do I check my PHP version in WordPress?
In your WordPress dashboard, go to Tools → Site Health → Info → Server. The hosting dashboard may also display the PHP version selected for your account or domain.
Does an updated WordPress site mean PHP is patched?
No. WordPress updates and PHP runtime patches are separate. A current WordPress installation does not by itself confirm that the server-side PHP environment has received a security patch.
What if my site reports PHP 7.4, 8.0 or 8.1?
Those versions are no longer supported upstream according to WordPress.org, so plan a compatibility review and upgrade path. However, do not assume your account is automatically unpatched: some hosting vendors may provide package-level backports. Ask your host to confirm the patch status for the PHP environment serving your site.
Sources: the PHP security release information and WordPress.org’s October 2026 advisory for WordPress site owners.
