What Liquid Web says
Liquid Web status incident 'PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)' (from 21 Oct 2026 09:24 EDT). At 13:57 EDT it said cPanel/WHM customers can patch by running a cPanel update and then a yum update; at 22:09 EDT its engineers were deploying patched builds across the hosting infrastructure. Patched builds listed: cPanel PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 plus vendor backports 8.1.34-5, 8.0.30-12 and 7.4.33-19; Plesk 18.0.81.4 with 8.2–8.5 and rebuilt EOL 7.4–8.1 builds dated 21 Oct; Windows Plesk 8.2–8.5. Customers are told to verify with a phpinfo file, run a package update from the control panel if not patched, and move off EOL PHP.
Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.If you are not currently patched, please try running a package update through your control panel.Customers using cPanel/WHM can patch PHP Versions 8.5, 8.4, 8.3, 8.2, along with the backported versions 8.1, 8.0 and 7.4may affect web servers running PHP 5.4 and later and could potentially allow remote code executionWhat you need to do
Check whether your site is patched with a phpinfo file (Liquid Web help article). If not, run a package update from your control panel; on cPanel/WHM that is a cPanel update followed by yum update. Sites on end-of-life PHP should move to a supported version as soon as the code allows.
Check which PHP your site runs
cPanel > Advanced > Terminal, run: php --version
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
cPanel > Software > MultiPHP Manager (tick domain, pick PHP Version, Apply); server default set in WHM; versions must be installed via EasyApache 4 in WHM. Plesk: Websites & Domains > Hosting Settings > PHP support. InterWorx: Nodeworx System Services > Web Server > Multiple PHP Versions, then per-domain in Siteworx.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Liquid Web.
Ask Liquid Web directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Liquid Web support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.