What DreamHost says
DreamHost status incident (21 Oct 2026) says protections went live across shared, VPS, DreamPress and dedicated platforms at 6:46 AM PDT, then PHP's official fix rolled out fleet-wide with the WAF blocking exploit attempts. At 10:59 PM PDT the fix was deployed across a large portion of the infrastructure, the remaining environments were in final stability tests, and the earlier mitigations stayed enforced. Sites on PHP 8.1 and older rely on those mitigations until fixes built under the PHP Extended Support program roll out, expected within a day of 1:43 PM PDT. No customer action required. It does not name the CVEs.
We have successfully completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure.Sites on PHP 8.1 and older are protected by the mitigations we deployed early, before the details were public.Security fixes for these versions, provided under our PHP Extended Support program, are being built and are expected to roll out within the next day.Known attack vectors and confirmed exploit paths across all PHP versions remain closed.protections against the PHP remote code execution vulnerability across all our hosting platformsWhat you need to do
None required per DreamHost. Switch to the newest PHP version in the panel when you can; sites on PHP 8.1 or older get fixes only through the paid PHP Extended Support add-on.
Check which PHP your site runs
DreamHost KB 'Viewing your site's PHP version and settings'; Manage Websites page shows PHP version; DreamPress: WordPress tab > WordPress section
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Manage Websites > Manage > Settings tab > Website Settings > Manage next to PHP > PHP Version dropdown > Change PHP Version
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
DreamHost sells PHP Extended Support for old PHP versions: $5/month for 1 site; $10 for 2-4 sites; $15 for 5-19 sites; $25 for 20+ sites (covers PHP 5.6-8.1). Product page Ask whether it covers CVE-2026-109618 and CVE-2026-109619 before relying on it.
Ask DreamHost directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello DreamHost support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.