What SiteGround says
Blog post of 21 Oct 2026 (last updated 11:30 UTC, before PHP's release) says server-level mitigation rules were rolled out on all servers and the affected functionality was disabled on all supported PHP versions; customers need to do nothing. The official PHP patch was still pending at that update; SiteGround said it would update the post once PHP publishes the release. Post and X post cite CVE-2026-109618 and CVE-2026-109619.
rolled out server-level mitigation rules across all SiteGround serversWe disabled the affected functionalities on all supported PHP versions.No updates, settings changes or PHP version switches needed.SiteGround customers are already protected.What you need to do
SiteGround says no action is needed. Customers on Managed PHP get automatic updates; if you pinned a PHP version manually it is not auto-updated, so check back for SiteGround's update on the official patch.
Check which PHP your site runs
Site Tools > Devs > PHP Manager
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
Site Tools > Devs > PHP Manager > pencil icon (Change PHP version) > 'Change PHP version manually' > choose version > Confirm
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at SiteGround.
Ask SiteGround directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello SiteGround support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.