Who installs the fix
On shared hosting, managed WordPress and most reseller plans, you never install PHP yourself. The host builds it and keeps several versions side by side, and your control panel decides which one runs your site. So the fix for CVE-2026-109618 and CVE-2026-109619 reaches you in two steps:
- The host installs the patched builds (8.5.12, 8.4.27, 8.3.36, 8.2.35, or its own backport for older branches).
- Your site runs one of those patched builds.
Step 1 is the host's job. Step 2 often falls to you: if your site is pinned to PHP 7.4 or 8.0 and the host has no fixed build for that branch, nothing gets patched until you move.
Check what your site runs
Your control panel shows the version per domain, and WordPress shows it under Tools › Site Health › Info › Server. Paste the full number into the version check. What counts is the number after the second dot: 8.3.36 is fixed, 8.3.30 is not.
Hosts that build their own PHP sometimes keep the upstream number and add a suffix, so a number that looks old may still carry the fix. If you are unsure, ask (see below).
What the big panels shipped
Most shared hosts sit on one of a few control panels, and the panel vendor usually builds the PHP the host installs.
| Panel | What the vendor says |
|---|---|
| cPanel (EasyApache 4) | Fixed builds for 8.2 to 8.5, backports for 7.4, 8.0 and 8.1. Details |
| CloudLinux alt-php (cPanel "Select PHP Version") | Builds being prepared. Details |
| Plesk | Fixes for 8.2 to 8.4 on Linux; more listed as they ship. Details |
| DirectAdmin | New builds on current and stable channels. Details |
A fixed build at the panel vendor may not be on your server yet. Hosts roll out panel updates on their own schedule.
What hosts have said
We list every host we checked, with quotes and dates, on the hosts page. Many have published nothing yet. Silence tells you nothing about whether a fix is installed, so ask.
If you are on PHP 7.4, 8.0 or 8.1
Upstream PHP fixed those branches with source backports and published no releases for them. Some panels built them (cPanel did); many hosts will not offer them. The lasting fix is a move to a supported branch. We recommend PHP 8.4: supported until the end of 2028 and widely offered by hosts.
Before you switch, take a backup, then switch on a staging copy if your host offers one. Old plugins and themes are the usual reason a site breaks after a jump.
Ask your host
Support teams answer precise questions faster. Copy this into a ticket and fill in the brackets:
Hello,
Regarding the PHP security fixes released on 21 October 2026
(CVE-2026-109618 and CVE-2026-109619, "PHP2Shell"):
1. My site [domain] currently runs PHP [version]. Does that build include
the fixes for both CVEs?
2. If not, when will a fixed build be installed, and which PHP versions on
my plan are already fixed?
3. Have the PHP workers serving my site been restarted since the update?
Thank you.
Do not drop question 3. A patched package changes nothing until the PHP processes that serve your site restart. See after patching.
What you can do today
Not a fix
Cloudflare and some hosts say their firewall rules block known attack patterns. PHP itself stays vulnerable behind any such rule. Treat it as cover until the patched build runs.
- Switch to a fixed version if your panel offers one.
- Update WordPress core, plugins and themes, and remove the ones you no longer use.
- Change the admin passwords and application passwords if you see anything odd in your logs or files.
- If you think the site was already attacked, follow the triage guide.
Last reviewed on 22 October 2026.