What GoDaddy says
GoDaddy blog post (dated 20 Oct 2026, updated 21 Oct 2026 16:45 UTC) says PHP shipped fixes and tells site owners to update PHP to the fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35). For VPS with cPanel/WHM, customers update via EasyApache 4 (ea-php82 8.2.35 and ea-php83/84/85 available) or buy GoDaddy Expert Services to do it. For PHP 8.1 and older it says cPanel backported the fix to its 7.4/8.0/8.1 packages but advises moving to 8.2+. The post does not say how or whether GoDaddy itself has patched shared or managed WordPress plans. GoDaddy's status page on 21 Oct showed an unrelated-looking 'Hosting Maintenance' restart of application services on managed hosting products, not tied to the CVEs.
It is not specific to GoDaddy.Updating to a fixed version is the only complete fix.We are restarting application services as part of maintenance on Managed Hosting Products.What you need to do
Update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or newer) via your panel's PHP version setting; on VPS update ea-php packages in WHM EasyApache 4 and restart PHP/web server, or ask GoDaddy Expert Services. Move off PHP 8.1 and older. Verify the running version afterwards.
Check which PHP your site runs
Product page > Web Hosting > Manage (cPanel hosting) > Dashboard shows the active PHP version; or Settings tab > Server Settings > PHP Version. WordPress: Tools > Site Health > Info > Server.
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Product page > Web Hosting > Manage > Settings tab > Server Settings > Change (next to PHP Version) > pick version > Continue > Save Changes
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at GoDaddy.
Ask GoDaddy directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello GoDaddy support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.