Patch PHP on Bluehost

Scope: Bluehost accounts exposing cPanel/MultiPHP Manager. Cloud or other managed products without those controls need Bluehost Support to confirm the update route. Checked 21 October 2026, approximately 14:12 UTC.

Patch status: The official page below verifies the selector workflow, not deployment of this incident’s fixes to your server. A branch label such as “8.3” does not prove remediation.

Walkthrough

1. Save a current files/database backup and record the site’s existing PHP version. If a branch migration is needed, test critical plugins and theme behavior on staging first.
2. Sign in to the Bluehost Portal. Select Hosting → My Plans.
3. On the hosting details page, open cPanel.
4. Under Software, open MultiPHP Manager.
5. Select the intended domain(s). Record whether the version is inherited; include subdomains and other sites sharing that configuration in your inventory.
6. Use the PHP Version dropdown and Apply only after Bluehost confirms that the offered build contains both fixes. If your existing supported branch is already patched, a branch change is unnecessary. Bluehost panel instructions

Confirm the actual fix

Open WordPress Tools → Site Health → Info → Server and record the full PHP version. For upstream builds, the first fixed versions are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. If Bluehost supplies a backport, obtain its complete build/revision and written coverage of CVE-2026-109618 and CVE-2026-109619. Ask for confirmation that all relevant PHP workers/nodes were replaced; the selector itself cannot prove this. These are incident-specific validation requirements; see the validation and rollback guide.

Test an uncached page, login, form, upload and checkout where applicable. Record evidence per site.

If unavailable or broken

Use Bluehost’s official support chat to request the patch status, affected domains, exact build, completion time/ETA and access restriction option. If changing PHP causes errors, ask support to restore a compatible patched runtime. A recovery to vulnerable PHP must remain isolated from public traffic until fixed. Do not upload PHP source archives into WordPress.

Fixed versions

Support request

Fill in the brackets and send it to Bluehost support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• Bluehost panel instructions bluehost.com

Researched from Bluehost’s public documentation on 21 October 2026, ~14:12 UTC, not inside a Bluehost account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Bluehost has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Bluehost.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon