Applies to Flywheel managed WordPress production and staging sites. Checked 21 October 2026, approximately 14:12 UTC. The PHP help page describes platform controls; it does not confirm completion of today’s incident patching.
Walkthrough
- Record a backup/recovery point and the current web PHP version. Test a required branch migration on staging first.
- Sign in to Flywheel and choose Sites.
- Select the site’s name, then open Advanced.
- Find PHP version in the right sidebar. The upgrade/downgrade control appears toward the lower right of that tab.
- If Flywheel confirms the current branch is already patched, no branch switch is needed. Otherwise use the control to choose a compatible branch that support confirms contains both complete fixes, and follow its confirmation prompts.
- For staging, open the site’s Staging tab and check/change its PHP version there separately. Do not assume the production selector covered staging.
- For a portfolio, use Sites → Filter Sites → Site Settings → PHP version to locate sites still on the branch requiring attention. Official PHP controls
Confirm before closing
Ask Flywheel support for the exact runtime build fixing CVE-2026-109618 and CVE-2026-109619, serving-node coverage and worker replacement. The help page lists branch choices, including a legacy option; a legacy branch or its presence in the panel is not itself evidence of a security backport.
In each WordPress environment, open Tools → Site Health → Info → Server and record the full version. Compare to the upstream fixed versions or retain Flywheel’s backport evidence. Verify login, a form, an upload and any checkout flow on dynamic requests.
If no patched build is available, use the shared support request to request an ETA and origin access restrictions. If a branch change breaks the site, have support recover it on a patched compatible runtime; isolate any vulnerable rollback. See the shared checklist and the validation and rollback guide.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to Flywheel support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Official PHP controls getflywheel.com
Researched from Flywheel’s public documentation on 21 October 2026, ~14:12 UTC, not inside a Flywheel account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Flywheel has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Flywheel.
Other hosts: SiteGround · GoDaddy · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon