What Pressable says
Pressable posted on 2026-10-21 that its sites are already protected against both CVEs across all offered PHP versions and Sandbox, Staging and Production sites, and that customers need not act.
Pressable sites are already protected against both vulnerabilities.Pressable customers do not need to take action.are already protected against the recently disclosed PHP security issuesWhat you need to do
None for sites hosted on Pressable. PHP running elsewhere should follow the PHP project's update guidance. Note Pressable retires PHP 8.2 on 2026-12-08 per its KB.
Check which PHP your site runs
my.pressable.com > select site > PHP Version (Site Information in Site Overview)
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
my.pressable.com > select site > PHP Version dropdown (applies immediately); account default under Account > Settings > Sites > Default PHP Version
Versions offered: 8.2, 8.3, 8.4.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
Pressable does not offer paid support for old PHP versions. Upgrading is the only route.
Ask Pressable directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Pressable support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.