What Bluehost says
Bluehost status announcement 'PHP Updates' (21 Oct 2026) first put mitigations in place, which may limit upload file size, then rolled out the PHP security patches. At 23:00 EST on 21 Oct it said the majority of servers were patched and the remaining systems were being completed, with mitigations kept as an extra layer until then. It does not name the CVEs or plans and asks for no specific customer action beyond keeping the environment current.
Our teams have successfully patched the majority of servers and are completing updates on the remaining systems.made significant progress applying the latest PHP security patches across our serversWhat you need to do
No action required per Bluehost. Keep WordPress, plugins and themes updated; optionally confirm your PHP version in the Portal. VPS/Dedicated customers should follow Bluehost's VPS/Dedicated best-practices guide and update their own packages.
Check which PHP your site runs
Portal > Hosting > My Plans > cPanel > Software > MultiPHP Manager (lists each domain's current PHP version)
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Portal > Websites > Manage Site > Advanced tab > PHP Version tile > Change Version > Apply; or cPanel > Software > MultiPHP Manager > select domain > PHP Version dropdown > Apply
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Bluehost.
Ask Bluehost directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Bluehost support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.