What HostPress says
HostPress status notice 'Aktuelle Informationen: Kritische Sicherheitslücken in PHP (PHP2Shell)' (from 22 Oct 2026 00:36) names CVE-2026-109618 and CVE-2026-109619. HostPress disabled Session Upload Progress on all servers and filters known attack patterns with Imunify360. Its sites run PHP-FPM rather than mod_php, so the risk is lower but not ruled out. By 06:30 on 22 Oct the patched PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 were on all Plesk servers, and sites still on PHP 8.1 or older were switched overnight to 8.2 or newer because tested patches for them were not yet available; switching back is not possible for now. HostPress asks those customers to test their sites and recommends renewing WordPress admin passwords and salts.
Auf allen Plesk-Servern sind die abgesicherten PHP-Versionen 8.2.35, 8.3.36, 8.4.27 und 8.5.12 eingespielt.Websites, die noch PHP 8.1 oder älter verwendet haben, haben wir in der Nacht auf PHP 8.2 oder höher umgestellt.Eine Rückstellung auf eine ältere PHP-Version ist derzeit nicht möglich.What you need to do
If your site ran on PHP 8.1 or older, HostPress has moved it to 8.2 or newer: test it now, including contact forms, the WordPress login and any shop checkout, and update outdated plugins or themes that break. Renew your WordPress admin passwords and security keys (salts). Sites on PHP 8.2 should move to 8.3 or newer in the coming weeks.
Check which PHP your site runs
WordPress admin > Tools > Site Health > Info tab > Server > PHP version
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Plesk > select domain > PHP > choose version > Uebernehmen
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at HostPress.
Ask HostPress directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello HostPress support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.