My host says PHP is patched. What's left for me to do?

WindowsMacUpdated

A host's patch updates PHP, the language its servers use to run your site. The PHP project released those fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The software you installed on top is a separate job: WordPress's hardening guide says web hosts look after the infrastructure, but "are not responsible for the application you choose to install".

Quick answer

Your host's patch covers PHP on its servers. On your own account, update WordPress or your CMS, plus its plugins and themes. Check which PHP version each of your sites actually uses, because cPanel lets every domain have its own. Check for signs of compromise, as the NCSC advises, and change your passwords if anything looks wrong.

What does my host's PHP patch cover?

It covers PHP itself. The PHP advisory of 21 October 2026 says two flaws, CVE-2026-109618 and CVE-2026-109619, affect all PHP installations serving web requests and can allow unauthenticated remote code execution. In plain terms, someone could run their own code on the server without logging in. The advisory names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, all of them server software, so on shared or managed hosting that update sits with your host.

The patch doesn't update WordPress, a theme or a plugin. Those have their own updates.

On exploitation, as of 23 October 2026: CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". The PHP advisory describes a demonstrated exploit against Apache with mod_php, the setup it rates highest risk.

Do I still need to update WordPress, plugins and themes?

Yes. WordPress's hardening guide says to "always keep up to date with the latest version of WordPress", and that older versions aren't maintained with security updates. It gives the same advice for plugins, and says to delete any you don't use. Take a backup first, as WordPress's update guide suggests.

  1. Log in to your dashboard and go to Dashboard > Updates.
  2. If a new WordPress version is listed, click Update Now.
  3. On the same screen, tick the plugins and themes that have updates waiting, then click the matching Update button. Ticking the box at the top of a section selects all of them.
  4. Go to Plugins > Installed Plugins and remove any plugin you no longer use.

WordPress says most sites now apply its minor and security releases automatically in the background, but a major release still needs you to click Update Now.

Which PHP version is my site actually on?

Check it rather than assume. cPanel's documentation says each domain can use any installed PHP version, so the version your host patched and the version each of your sites runs are worth confirming separately. Our guide on how to check your website's PHP version shows where to look in WordPress and in cPanel. If a site is on an older release, how to update PHP on WordPress explains how to switch it. PHP 8.1 and older "no longer receive updates from the PHP project", so a site on one of those needs a word with your host.

Should I check my site for signs of compromise?

Yes, if there was any gap before the patch. The NCSC's PHP guidance tells anyone who can't update or disable a system straight away to "assess the system for any evidence of compromise prior to your upgrade or mitigation", and to look for backdoors. A newer PHP fixes the flaw. It doesn't tell you whether anything happened before.

  1. Go to Users > All Users and click the Administrator link above the table. WordPress's FAQ on hacked sites lists the creation of new users as a clear sign.
  2. Open the Security issues report in Google Search Console. Google says it shows its findings if your site was hacked or could harm visitors.
  3. Ask your host whether it has flagged anything on your account.

Our guide to the signs your WordPress site was hacked goes through each check in more detail.

When should I change my passwords?

Straight away if anything looks wrong. WordPress's FAQ says to change every access point, which it lists as FTP or SFTP, the WordPress admin, cPanel or any other hosting panel, and the database, for every user with access, not only you. What to do if your website is hacked has the passwords in order, with the rest of the first-hour checklist.

What should I ask my host?

Short, factual questions get the most useful answers.

  1. Which PHP version is each of my sites running on now, and is it 8.5.12, 8.4.27, 8.3.36 or 8.2.35?
  2. If any of my domains is set to Inherited, what is the server's default version?
  3. If a site is on PHP 8.1 or older, have you applied a backported fix? The PHP project says some vendors provide them.
  4. Have you set session.upload_progress.enabled=0, which PHP's informational advisory of 23 October suggests until the next regular bugfix release?
  5. Have you seen anything on my account, or on the server I share, that points to a compromise? WordPress's FAQ says a hack on shared hosting may affect more than one site.
  6. What backups of my site do you hold? WordPress suggests asking your host about its backup policy.

More questions

Is my hosting provider affected by PHP2Shell?

If it runs PHP to serve websites, it was in scope until it updated. The NCSC says "Organisations using any version of PHP are affected", and CISA notes that PHP is often a component of other software. Our PHP2Shell explainer covers the flaws themselves.

My host patched PHP. Is my site safe now?

The two PHP flaws are fixed on the patched releases. WordPress's hardening guide also points out that on a shared server, your site "can potentially be compromised too" if another site on that server is. Your own updates, version check and compromise check still matter.

Does a web application firewall do the same job as the patch?

No. CISA says a web application firewall may help until patching is done. The PHP advisory says only an update is a complete solution, and that its temporary mitigations "do not make an installation safe".

What was the 23 October PHP advisory about?

A separate, unlikely remote code execution route, CVE-2026-115560. PHP says it needs an unusual combination of configuration and application code, and suggests setting session.upload_progress.enabled=0 until the next regular release. That setting is on the server, so your host makes it.

Should my site go offline until the host patches?

The NCSC says to consider taking a system offline if it can't be updated or mitigated quickly. CISA says to take PHP systems offline if they can't be updated straight away, or still run PHP 8.1 or earlier. Once your site is confirmed on a fixed release, that advice no longer applies to it.

Sources