A WordPress dashboard with no pending updates can still leave one important question unanswered: has your hosting provider installed the latest PHP security patches? PHP runs your website’s server-side code, so its maintenance needs attention alongside WordPress, themes and plugins.

This guide explains the emergency release announced on 21 October 2026 and the practical checks website owners should make with their host.

Why these PHP security patches matter

PHP’s official security advisory identifies CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution, meaning an attacker may run code on a server without logging in.

The advisory covers PHP installations serving web requests, including PHP-FPM, Apache mod_php and LiteSpeed. PHP considers mod_php the highest-risk configuration. These are runtime vulnerabilities, so an otherwise well-maintained application still needs its hosting environment checked.

Which versions include the PHP security patches?

The emergency releases are:

Some operating-system vendors supply backported fixes. Ask your host to confirm that its installed package addresses both CVEs rather than judging protection from a version number alone. PHP 8.1 and older need vendor-specific guidance or an upgrade to a supported branch.

How to check your WordPress hosting

Open Tools > Site Health > Info > Server in your WordPress dashboard and record the PHP version. Your hosting control panel may also show it. WordPress documents these details in its Site Health guide.

Next, contact your host with a specific request. A general assurance that “the server is up to date” is less useful than confirmation of the security fix and when it reached your website.

Please confirm whether the PHP runtime serving my website has fixes for CVE-2026-109618 and CVE-2026-109619. Which package or release is active, and have the relevant services been restarted? Please also confirm whether staging sites and other hosted domains need attention.

Keep the response with your maintenance records. If another company manages your website, forward the confirmation so everyone works from the same information.

Apply PHP security patches with a clear test plan

WordPress’s PHP update guidance recommends backups, current themes and plugins, and compatibility checks. Use those preparations to support a prompt update rather than turning an urgent fix into an open-ended project.

1. Confirm a usable backup. Include the database and files, and establish who can restore them if required.
2. Agree the update with your host. Ask which supported release suits the site and whether a staging check can happen promptly.
3. Test business-critical journeys. Check sign-in, forms, search and file uploads. For an online shop, use its approved test-payment process to check checkout and order emails.
4. Verify after deployment. Recheck the active runtime with the host and ask the developer to review unexpected errors.

For example, a brochure site might load normally while its enquiry form fails. A useful test therefore includes sending a test enquiry and confirming delivery, not simply opening the homepage.

Are security plugins or firewalls enough?

PHP states that temporary measures do not provide a complete solution. Keep these points in mind:

• Update the PHP runtime. Security plugins and firewall rules do not replace the required patch.
• Use firewall protection as an additional layer. It is not evidence that patching can wait.
• Escalate compatibility problems promptly. Involve your host and developer if testing reveals an issue.
• Agree a recovery plan. Address both availability and security instead of leaving an older runtime in place without a plan.

Make the hosting check part of website maintenance

Make the follow-up clear and easy to repeat:

• Assign an owner. Choose one person to obtain written patch confirmation from your host.
• Check essential journeys. Ask another person, where possible, to test the website’s important functions.
• Record the result. Keep the confirmed PHP package or release, update date and test results with your maintenance records.
• Track follow-up work. Give any errors or compatibility issues a named owner and a clear next step.

These checks answer two separate questions: did the host apply the fix, and does the site still work?

Hosting also affects the everyday experience of visitors. For broader maintenance work, read our guide to why a WordPress website can be slow and what to check.

Your next step: send your host the two CVE identifiers and request written confirmation that the PHP runtime serving your site has the fixes.

Release information checked on 21 October 2026. Refer to PHP’s official advisory and your hosting provider for subsequent updates.