Patch PHP on Cloudways

Scope: Cloudways Flexible PHP applications, including WordPress. Checked 21 October 2026, approximately 14:13 UTC.

Release-window status: Cloudways Status reported critical maintenance 13:35–15:05 UTC and a separate PHP incident describing interim mitigations. Neither entry proves that your application runtime is fully patched. Recheck the provider’s completion notice. Cloudways Status

Walkthrough once platform access returns

1. Take an on-demand application backup, record the app/server IDs and current runtime, and test any branch migration on staging.
2. In Flexible, open Applications and choose the application.
3. Open Application Settings → PHP Settings.
4. Beside PHP Version, click the edit icon.
5. In Update PHP Version, choose a supported branch whose current build Cloudways confirms contains the fixes, then select Proceed. The documented change restarts that application’s PHP service and may cause brief backend interruption.
6. Repeat for every application. Cloudways’ documentation describes application-specific versions; changing a server default does not automatically replace an existing application override. If these controls are absent on your server, request its applicable update route from support. Official application-level guide

Prove remediation

Check WordPress Tools → Site Health → Info → Server. Require upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or a documented backport covering CVE-2026-109618 and CVE-2026-109619. Ask support for exact build/revision, coverage of every application/runtime and confirmation that old workers exited. Do not equate an interim mitigation, dropdown branch or successful panel change with completed patching.

Test login, forms, upload, background jobs and checkout. Check separate cron/CLI runtimes with the operator; see the validation and rollback guide.

Blocked access or failure

Use Cloudways’ official support channel and status updates. Request a patch ETA and origin access restrictions if remediation is delayed. Do not improvise a root-level package replacement on the managed platform. If compatibility recovery requires vulnerable PHP, isolate the affected app until a patched compatible runtime is supplied.

Fixed versions

Support request

Fill in the brackets and send it to Cloudways support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• Cloudways Status status.cloudways.com
• Official application-level guide support.cloudways.com

Researched from Cloudways’s public documentation on 21 October 2026, ~14:13 UTC, not inside a Cloudways account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Cloudways has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Cloudways.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon