Primary walkthrough: Managed Hosting for WordPress, not GoDaddy Website Builder or a self-administered VPS. Checked 21 October 2026, approximately 14:12 UTC. The documentation verifies selector steps, not completion of today’s patch rollout.
Walkthrough — Managed WordPress
- Confirm a recent restorable backup. Use staging to test a PHP branch migration before changing production.
- Sign in to the GoDaddy My Products page.
- Next to Managed Hosting for WordPress, choose Manage All.
- Open the site’s options menu and select Settings.
- Under Production Site, locate PHP version and choose Change.
- If support confirms your existing branch already contains both fixes, leave it selected. If a different branch is needed, choose a compatible version GoDaddy confirms is patched, then Save Changes. Official Managed WordPress steps
Other GoDaddy products
GoDaddy’s cPanel and Plesk hosting have separate PHP procedures. First identify the hosting product on the account, then follow the matching link from its PHP guidance. Do not look for the Managed WordPress Production Site control inside cPanel or assume a VPS receives the same managed updates. If the product/control differs, use GoDaddy support to identify the correct runtime change route.
Verify the actual fix
In WordPress, open Tools → Site Health → Info → Server. Record the full PHP version, not just the panel’s major/minor label. Upstream minimums for this incident are 8.2.35, 8.3.36, 8.4.27 or 8.5.12, within the corresponding branch. For a vendor backport or extended-support PHP, ask for explicit coverage of both CVEs and the complete build revision.
Ask GoDaddy to confirm that the installed build fixes CVE-2026-109618 and CVE-2026-109619, completion across all serving nodes and replacement of old workers; a successful selector change alone does not establish that. Test a dynamic page, login, form, media upload and checkout. If blocked, use the support request and request an ETA/access restriction. For recovery, keep any vulnerable prior runtime isolated. Shared checks: completion checklist.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to GoDaddy support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Official Managed WordPress steps godaddy.com
- PHP guidance godaddy.com
Researched from GoDaddy’s public documentation on 21 October 2026, ~14:12 UTC, not inside a GoDaddy account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that GoDaddy has finished rolling out the patch for your site. Clarity Messaging is not affiliated with GoDaddy.
Other hosts: SiteGround · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon