What A2 Hosting (hosting.com) says
hosting.com (formerly A2 Hosting) status incident 'PHP Update' (opened 21 Oct 2026, 'Recovering' since 16:06 CST): upstream patches were deployed across the fleet in rolling waves, and at 01:17 CST on 22 Oct the patched PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were available on its servers. Customers on unmanaged servers must apply the patches themselves. No patch will be provided for PHP 8.1 or earlier; hosting.com urges upgrading to a supported version. It does not name PHP2Shell or the CVEs.
The patched versions are now available for our serverscustomers using unmanaged servers are responsible for applying the necessary patches to their own environments.If your server is running on PHP version (8.1 or earlier), no official patch will be provided for that version.Patches from upstream vendors have been released and are currently being deployed across the fleet in rolling waves.What you need to do
Sites on PHP 8.1 or older: switch to 8.2 or newer now in cPanel > Select PHP Version, since hosting.com will not patch them. Unmanaged server customers: install PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 yourself. Everyone else: watch the status incident until it is resolved.
Check which PHP your site runs
cPanel > Software > Select PHP Version (shows current PHP version)
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
cPanel > Software > Select PHP Version > choose 'Current PHP Version' > Apply (takes effect immediately; icon absent on servers without PHP Selector)
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at A2 Hosting (hosting.com).
Ask A2 Hosting (hosting.com) directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello A2 Hosting (hosting.com) support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.