PHP security update completed on all Whostpress servers
Friday, 23rd October, 2026 at 07:00am
On 21 October 2026, two critical security issues were found in PHP, the software that runs WordPress and most websites (CVE-2026-109618 and CVE-2026-109619). If left unpatched, they could let an attacker take control of a website without logging in.
What we did
- We installed the fixed PHP versions (8.2.35, 8.3.36 and 8.4.27) on all Whostpress servers, and security fixes for older PHP versions (7.4, 8.0 and 8.1).
- We restarted all website services so the fix is fully active.
- We checked websites for signs of misuse and are monitoring all servers closely.
The update was completed by 23 October 2026.
Do you need to do anything?
No. The update is already applied to your hosting account, and there is no charge. As a good habit, we recommend keeping WordPress, your themes and your plugins up to date.
Did this affect my website?
Some websites showed errors for a short time on 22 October while the update was applied. If you notice any problem with your website or email, please open a support ticket and we will help right away.
