Scope: Two distinct DreamHost products: ordinary Fully Hosted websites and managed DreamPress. Checked 21 October 2026, approximately 14:13 UTC. General upgrade articles do not prove a completed CVE patch on your account.
Before either route, preserve a current backup, record the full web PHP version, and test any required branch change on staging.
Ordinary Fully Hosted WordPress
- Open Manage Websites and click Manage for the domain.
- Select Settings. Under Website Settings, choose Manage beside PHP.
- Scroll to PHP Version, select the confirmed patched branch, and click Change PHP Version.
- Choose the failure behavior offered by the panel, then confirm Change PHP Version. DreamHost says completion generally takes less than five minutes. If its compatibility check restores the old runtime, treat that as an incomplete security change.
- Managed VPS using Nginx changes PHP at server level through Server & Users, rather than this per-domain route; ask support if that applies. DreamHost standard-site instructions
DreamPress
- Open Manage Websites → Manage → WordPress to view the current PHP version.
- For staging tests, open WordPress → Manage Staging → Manage → Configure PHP → Modify.
- Select the available patched branch and choose Change PHP to…. Test the staged site.
- Arrange the production PHP update through the panel or DreamHost Support. Publishing staging can also copy its PHP version, but copies site changes too: do not overwrite newer production orders/content merely to change PHP. The documented staging route cannot downgrade production PHP. DreamPress upgrade guidance, staging PHP instructions
Completion and recovery
Check WordPress Tools → Site Health → Info → Server. Require upstream 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or explicit vendor-backport evidence covering both CVE-2026-109618 and CVE-2026-109619. Ask support for the full build, all-node coverage, worker replacement and completion time. Test login, forms, upload and checkout. See the validation and rollback guide for incident evidence requirements.
If a patch is pending, request an ETA and restriction of public PHP access. The presence of unsupported versions in a selector is not evidence of coverage. If recovery restores vulnerable PHP, keep it isolated until a compatible patched runtime is available.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to DreamHost / DreamPress support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- DreamHost standard-site instructions help.dreamhost.com
- DreamPress upgrade guidance help.dreamhost.com
- staging PHP instructions help.dreamhost.com
Researched from DreamHost / DreamPress’s public documentation on 21 October 2026, ~14:13 UTC, not inside a DreamHost / DreamPress account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that DreamHost / DreamPress has finished rolling out the patch for your site. Clarity Messaging is not affiliated with DreamHost / DreamPress.
Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon