What Kinsta says
Kinsta status incident 'PHP Security Vulnerability Update' (21–22 Oct 2026, resolved 08:26 UTC on 22 Oct): PHP is managed at platform level and fixes were deployed automatically once validated, starting with 8.3 and 8.5. Patches for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 have been rolled out across the platform, and Kinsta reports no evidence of breaches. Its Cloudflare firewall rules and local configuration changes stay in place for all sites until further notice. No customer action required. It does not name the CVEs.
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5No action is required on your end.What you need to do
None required per Kinsta. Sites on PHP 7.4, 8.0 or 8.1 are patched now but should still move to a supported version.
Check which PHP your site runs
Kinsta does not document this on the pages we read.
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
MyKinsta > Sites > [site] > Tools > PHP settings > Change (bulk: Sites > select sites > Actions > PHP settings > Change PHP settings)
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
Kinsta sells Kinsta LTS and security monitoring for end-of-life PHP (7.4 and 8.0 at last changelog update, April 2025) for old PHP versions: Free (per Kinsta changelog). Product page Ask whether it covers CVE-2026-109618 and CVE-2026-109619 before relying on it.
Ask Kinsta directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Kinsta support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.