Two critical PHP vulnerabilities have prompted emergency updates across hosting platforms. If your website uses PHP, check with your host today. Updating WordPress, a theme or a plugin does not install these PHP fixes.
PHP released the fixes on 21 October. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on vulnerable servers without logging in. PHP warns that all installations serving web requests are at risk. This includes PHP-FPM, Apache with mod_php, CGI, FrankenPHP and LiteSpeed.
The response has involved software vendors, managed platforms and individual web hosts. Some issued customer warnings. Others published patch instructions or reported maintenance and staged updates. During our own checks, we also received emails and asked hosting support teams about their response.
Read the official PHP security advisory
Which PHP Versions Need the Fix
The fixed upstream releases are:
| PHP Branch | Fixed Release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
These releases address both vulnerabilities. Apache with mod_php has the highest risk identified by the PHP team. Its advisory describes a demonstrated attack that can run before application code starts.
A lower version number does not always mean a vendor package remains vulnerable. Some vendors apply security fixes to older versions, a process called backporting. Ask for the installed package revision and confirmation that it covers both CVEs.
PHP 8.1 and older no longer receive regular security updates from the PHP project. Vendor coverage must be checked separately. PHP 8.2 security support ends on 31 December 2026.
How Hosting Providers and cPanel Responded
The public notices below describe different parts of the response. A vendor releasing a package does not establish that every host has installed it. A host reporting completion applies to the service scope named in its notice.
| Provider or Platform | Publicly Recorded Response | What Site Owners Should Check |
|---|---|---|
| cPanel | cPanel published patched cPanel & WHM builds and EasyApache PHP packages. Its advisory lists CloudLinux packages separately, including backported fixes with older PHP version numbers. | Ask the administrator to check both the control panel and the PHP packages serving the website. Use the package list for the relevant vendor. cPanel advisory |
| CloudLinux | CloudLinux reported fixed EasyApache and alt-php packages available for specified platforms. Some native operating-system PHP packages remained in a gradual rollout. | Confirm the package family and repository used by your server. Package availability still requires installation and the relevant service restarts. CloudLinux update |
| Cloudways | Cloudways reported interim protections and a staged rollout. It reported Autonomous applications patched at 9:02 a.m. on 22 October. Its 3:03 p.m. update said most servers were patched, with remaining work expected to finish by 5 p.m. | At this reporting cutoff, completion of the entire rollout had not been confirmed. Check the current incident update and the product hosting your application. Cloudways PHP incident |
| AltusHost | AltusHost published an advisory on 21 October. It explained the vulnerabilities and the different responsibilities for shared, managed and unmanaged hosting. | Confirm the status of your service. The advisory’s publication date alone is not a timestamp for completion across all servers. AltusHost advisory |
| Serverfreak | Serverfreak’s 22 October notice said all shared servers had been patched. It also described applicable managed-server patches and warned that backported fixes may leave the displayed PHP version unchanged. | Check whether your service is shared, managed or self-managed. Self-managed customers remain responsible for updating their servers. Serverfreak notice |
| Qikify | The Shopify app developer said all its apps were running patched PHP in production by 11:07 a.m. on 22 October. | This statement covers Qikify’s apps. It does not establish the patch status of Shopify’s core platform or other developers’ apps. Qikify notice |
Cloudways Website Maintenance and Customer Patching Were Separate Events
During the night of 21 October in Malaysia, we saw Cloudways redirect its public website to its status page. Cloudways’s public incident record confirms that its website and affiliate portal became unavailable while PHP patches were applied. It reported both services restored at 3:48 a.m. on 22 October (source).
That incident should be distinguished from the customer PHP rollout (full details here). Cloudways reported patches complete for Autonomous applications while Flexible updates continued. Its notices do not establish that all customer websites went offline.
What We Received and Heard From Web Hosts
We received warning emails from AltusHost, Atlantic.Net, DigitalOcean, Shopify, and BionicWP. These messages are part of our firsthand record of how providers communicated the issue. Receiving an alert establishes that the provider sent a warning; the message’s wording determines whether it also confirms a completed update.
During support conversations on the morning of 22 October, Malaysia time, representatives at Serverfreak, TMDHosting, Kinsta, Flashcloud, HostPapa, and ScalaHosting told us that patching had been completed. Those are support confirmations for the services discussed. We have not independently audited every server operated by these providers.
The exchanges showed prompt responses during our checks. They do not establish a ranking of which provider patched first. A fair comparison would need matching service scopes and confirmed completion times.
What You Should Do Today
- Identify the PHP environment serving your site. Check your hosting panel. WordPress users can open Tools → Site Health → Info → Server. Ask your host if the version shown belongs to the live website.
- Confirm that both CVEs are fixed. Request the installed package or build, the affected service scope and the completion time. For self-managed servers, your administrator must install the appropriate vendor updates.
- Check every relevant application and server. Include subdomains, staging sites and other PHP applications. Ask whether additional servers or workers still need the update.
- Back up and test essential functions. Keep a current copy of your files and database. After patching and the required service restarts, check logins, forms, checkout and scheduled tasks.
- Escalate delays. PHP says temporary measures do not provide complete protection. Ask your administrator about current official measures and whether the affected service should be temporarily restricted or taken offline.
You can send your host this question:
Has every PHP environment serving our website been patched for CVE-2026-109618 and CVE-2026-109619? Please confirm the running package or build, the services covered and when the update finished.
For this incident, a useful confirmation names the affected service and the fix actually running. Keep that confirmation with your website maintenance records.
Note: Reporting cutoff 22 October 2026, 4:23 p.m. Malaysia time (08:23 UTC). All times below use Malaysia time unless stated otherwise.
