Last updated: 22 October 2026, 12:00 UTC. PHP has released the fixes, and they’re now applied across all SiteGround servers.
PHP has announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. PHP fixed both in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. According to W3Techs, PHP runs on 69.3% of websites whose server-side language is known, WordPress sites included. That means a flaw in the language itself reaches much further than a bug in a single plugin or theme.
If your site is hosted with SiteGround, you’re already protected. Our security team put protective measures in place across all our servers before the official release, then applied PHP’s official fixes the same day. There’s nothing you need to do.
Key points at a glance
- What happened: PHP disclosed two critical vulnerabilities in the language itself, CVE-2026-109618 and CVE-2026-109619.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026.
- SiteGround clients: Protected before the release, official fixes applied immediately after. No updates, settings changes or PHP version switches needed.
- Sites hosted elsewhere: Update PHP to a fixed version now.
What SiteGround has already done
After PHP’s advance notice, our security team assessed the available information and rolled out server-level mitigation rules across all SiteGround servers. We disabled the affected functionalities on all supported PHP versions. Once PHP released the fixes on 21 October, we applied them across all SiteGround servers.
You don’t need to update anything or change your PHP version. As a managed platform, we handle this at the server level, so the protection applies to your site automatically.
Why acting before the release matters
The riskiest time for any critical vulnerability is right after the details go public, when attackers start scanning for servers that haven’t been updated yet. Because we acted before the release, our servers are already protected when that window opens. We’ll keep monitoring the release and take any further steps needed to keep your sites safe.
What we know about CVE-2026-109618 and CVE-2026-109619
PHP announced the security release in an advance notice on php.net on 20 October 2026. In it, PHP confirmed:
- Two vulnerabilities, both rated critical with a CVSS v4.0 score of 9.2
- A security release scheduled for 21 October 2026 at 14:00 UTC
- Full technical details, affected versions and fixed versions will be published with the release
PHP has since published the full details in its security advisory. Both vulnerabilities can allow unauthenticated remote code execution and are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
If you run PHP outside SiteGround
If you use PHP on another hosting provider, your own server or a local development setup, follow PHP’s advice and upgrade as soon as fixed versions are available. Check php.net for the official advisory and the list of patched versions.
Proactive security by design
We were able to move ahead of this release because of how we run our platform:
- An in-house security team. Our security specialists monitor vulnerability disclosures around the clock and assess new threats as soon as information becomes available.
- Engineers on call 24/7. Protective measures go out when they’re ready, not when the next business day starts.
- A fully managed server environment. We run and maintain our hosting infrastructure ourselves, so we can roll out protections across every server at once instead of waiting for each site owner to act.
We’ve used the same approach in our earlier responses this year, when we patched five Linux kernel exploits in 48 hours with zero downtime, and updated UpdraftPlus on every affected WordPress site in less than an hour.
Protection that doesn’t wait
Most of our security work never makes it to the blog. We monitor, patch and harden our servers every day, whether or not a vulnerability is in the news. This release gets a post because PHP sits under so many websites, but our response followed the usual approach: spot the risk early, act on our servers, and keep your site protected without adding anything to your to-do list.
Hosting with us means this is our job, not yours. Our support team is available 24/7 if you have any questions.
Frequently asked questions
They’re two critical vulnerabilities in the PHP programming language, both rated 9.2 on the CVSS v4.0 scale. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
No action is needed. SiteGround has already put protective measures in place across all its servers, so sites hosted with us are covered at server level.
No. SiteGround manages PHP at server level, so the protection applies to your site without any change on your end.
WordPress runs on PHP, so a flaw in PHP can affect WordPress sites regardless of which plugins or theme they use. On SiteGround, your WordPress site is already protected.
Check with your hosting provider, or upgrade PHP yourself as soon as fixed versions are available on php.net.
If one site runs with 8.2 and another runs with 8.3 (and so on) with manual PHP option, how does these sites are protected at server level in SiteGround?
Hi there! Thanks for your question!
Our engineers have implemented server-level mitigations and applied the necessary security patches across all supported PHP versions, regardless of whether your websites use Managed PHP or a manually selected version.
This means that websites running different PHP versions are protected against these specific vulnerabilities without requiring any changes to their PHP settings.
No additional action is needed on your part!
Thank you for acting so quickly!
Thank you! Our team moved quickly to put the necessary protections in place, and we’re happy we could address the situation promptly.
Thanks for the fast update! Many older sites use PHP 7.4 (still offered by Siteground). Even though that old version isn’t receiving normal updates, due to the severity of the PHP issue I read there has been a patch of some kind created to address the critical issue for that older version. Has Siteground installed that patch as well?
Hi there! Thanks for your question! Our engineers have already implemented the necessary server-level security mitigations to address these specific vulnerabilities across all PHP versions available through Site Tools, including PHP 7.4. These protections are already in place, so no additional action is required on your part.
Awesome update, thanks Siteground Team. I’m going back to bed to sleep peacefully.
You’re very welcome, Mike! Glad we could put your mind at ease. Wishing you a good night’s sleep!
Well done sitegound
Good work
Reassuring to know you have our back in this new age of Ai powered cyber threats
Really appreciate your kind words! The security landscape is constantly evolving, and so are the challenges that come with it. Our team is continuously working to stay ahead of emerging threats and keep your websites protected.
Thank you for keeping our websites safe.
It’s our pleasure, Diane! Thank you for trusting us with your websites. Their security is something we take very seriously.
Thank you for the updates!
You’re very welcome, Rodney! We appreciate your support!
I was planning to upgrade all the php versions for this after heard about this big PHP thinging.
Glad to hear that i dont need to do lots of tedious work as i have many websites hosted in siteground.
Glad we could save you some time and effort, Jack! We know that managing multiple websites comes with plenty of work already, so being able to handle these security measures on our end is especially important. You can continue using your current PHP versions without making changes specifically for these vulnerabilities.
Nice to read this worldwide PHP vulnerability has been dealt with at server level by Siteground.
Thanks for your comment, Fred! Keeping our customers’ websites protected is always a priority, and we’re glad we could provide some peace of mind with this update.
So have you patched your servers yet or not?
Hi there! Yes, we can confirm that our engineers have already applied the necessary security patches and mitigations across all supported PHP versions on our servers. The updates are in place, and no additional action is required on your part to address these vulnerabilities.
Thank you! Such a relief!
Our pleasure, Karyn!
If one website run with PHP 7.4 with manual PHP setup, is the website also protected? Or it is still vulnerable?
Hi David! Yes, websites running PHP 7.4 with a manually selected PHP version are also covered by the server-level security mitigations our engineers have implemented to address these specific vulnerabilities.