Hosting security guidance
Important PHP security updates
PHP is behind-the-scenes software that helps websites such as WordPress work. Whether you need to do anything depends on your hosting plan.
General guidance, not an account-specific patch confirmation or a statement that your website was compromised.
First, find the next step for your plan
GoDaddy reports the October 21 PHP fixes are applied to Managed WordPress, Web Hosting and Windows Hosting. Customers on those provider-managed platforms do not need to install these PHP fixes themselves.
Not sure which plan you have? Open My Products below and find the product name. Ask support: “Does my hosting need any action for the October PHP security updates, or has the platform update been handled for me?”
A server update is separate from maintaining your website’s own software. Ask whoever looks after your site to keep its plugins (add-on features), theme (the site’s design) and custom code up to date, with backups and checks that important pages still work.
- Fully Managed VPS: ask your server-management team to confirm whether your service covers this update and whether it has been applied. Ask them to handle any remaining work included in your plan; you do not need to change server settings yourself.
- Self-managed VPS: ask your administrator or web developer to back up the site, install the update, restart the affected software and test the site. No administrator? Ask support about assistance and any cost before work starts.
- Hosted elsewhere: ask that provider whether the PHP update is in place and who handles any remaining work.
What is the vulnerability?
PHP’s October 21 updates fix two critical flaws: CVE-2026-109618 and CVE-2026-109619. They can allow attackers to remotely run code through vulnerable PHP web requests. An advisory alone does not show that your website was attacked.
For your administrator: how to update PHP
These server instructions are for the person who manages a self-managed server, or the team handling it for you. If your hosting provider takes care of PHP updates, you do not need to follow these technical steps yourself.
- Back up files and databases; confirm you can restore them.
- Install supported, vendor-approved PHP updates compatible with your applications. Update applicable control-panel components too. In WHM use EasyApache 4; in Plesk check each domain’s PHP handler.
- Restart applicable PHP workers and services, then test your website, sign-in, checkout and uploads.
If you cannot update right away
Have your administrator review PHP’s temporary mitigations while arranging updates. They are incomplete for the October 21 flaws and require compatibility testing.
How to check the update
Check each website’s active PHP handler and vendor package—not only command-line php -v. Keep update and restart records. Prefer your panel or support; publicly accessible phpinfo pages expose configuration. Remove any diagnostic phpinfo page after use.
Upstream PHP fixes
| PHP branch | Fixed upstream release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Vendor backports and the separate advisories in this guide need their own checks. PHP 8.1 and older no longer receive PHP-project updates; plan a supported upgrade.
On Web Hosting, check the package and build
Backported fixes can retain older version numbers. GoDaddy’s October 21-or-later build-date check is for its Web Hosting packages—not all servers. Confirm the vendor advisory or changelog for both CVE IDs; CloudLinux now also offers upstream-numbered builds.
Separate upload and Windows advisories
October 23: PHP advised session.upload_progress.enabled=0 for a separate, configuration-dependent issue (CVE-2026-115560), pending a routine fix. Configure it before request parsing, restart workers and test upload progress; ini_set() is insufficient.
October 26: PHP rebuilt Windows packages with updated Brotli (CVE-2026-111497). Check the -1 package suffix; the PHP runtime version stays unchanged.