What Namecheap says
Namecheap status post '[ONGOING] PHP Security Vulnerability affecting Hosting Services' (21 Oct 2026) names PHP2Shell (CVE-2026-109618, CVE-2026-109619). It says protective mitigations were deployed first, then rollout of the patched PHP releases began; at 12:50 PM EDT it said public services are mitigated and final patching continues. VPS and dedicated server owners manage their own PHP and must update. The post names no fixed version numbers.
All public services affected by those vulnerabilities are mitigatedplease update PHP now to the fixed versionWhat you need to do
Shared/reseller customers: keep CMS, themes and plugins current and watch for odd behaviour. VPS and dedicated server owners: update PHP to the fixed version immediately.
Check which PHP your site runs
cPanel > Exclusive for Namecheap Customers > Select PHP Version (shows Current PHP version); Business servers: PHP Tweaks. Namecheap KB 9397 'How to check PHP version and configuration'.
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
cPanel > Exclusive for Namecheap Customers > Select PHP Version (sometimes under Software) > choose Current PHP version > Apply
Versions offered: 5.2, 5.3, 5.4, 5.5, 5.6, 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Namecheap.
Ask Namecheap directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Namecheap support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.