What Hostinger says
Hostinger status incident 'PHP Security Update for Web, Agency and cPanel Hosting' names CVE-2026-109618 and CVE-2026-109619. On 21 Oct 2026 it said tests showed its platform was not vulnerable and an extra protection layer was added, but it would still roll out patched PHP. cPanel servers got cPanel build 138.18 with the fix by 03:34 UTC on 22 Oct, and at 06:44 UTC PHP upgrades were complete across all managed hosting servers. The fix was added to the existing PHP version, so a site can still show 8.5.11; a PHP Info Build Date of 21 Oct 2026 or later means it is patched. Web, Agency and cPanel Hosting customers need not act; VPS customers manage PHP themselves.
PHP upgrades are now complete across all managed hosting servers.If the Build Date is October 21, 2026 or later, your website has the fix.No action is needed from clients on our Web Hosting, Agency Hosting, or cPanel Hosting plans.Versions below 8.2 can't be selected.What you need to do
Web, Agency and cPanel Hosting: nothing to do. To confirm, open PHP Info in hPanel and check that the Build Date is 21 Oct 2026 or later (the version number may still read 8.5.11). VPS customers manage PHP themselves and should follow Hostinger's PHP2Shell guide.
Check which PHP your site runs
hPanel > Websites > Dashboard > PHP Info in the sidebar; the Build Date must be October 21, 2026 or later
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
hPanel > Websites > Dashboard > PHP Configuration > pick version > Update
Versions offered: 8.2, 8.3, 8.4, 8.5.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Hostinger.
Ask Hostinger directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Hostinger support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.