Patch PHP on GreenGeeks

Applies to: EcoSite/shared and reseller accounts using GreenGeeks cPanel PHP Selector. VPS configurations differ. Official instructions checked 21 October 2026, 14:11 UTC; they explain version selection and do not confirm completion of this incident’s patch rollout.

Walkthrough

1. Record the PHP version in WordPress Tools → Site Health → Info → Server. Make a files/database backup and record required extensions. Test a branch change on staging when available.
2. Sign in to GreenGeeks and open the account’s cPanel.
3. Under Software, open Select PHP Version.
4. Review the current selection. GreenGeeks calls the default build native. If the host confirms your existing build contains both fixes, no branch switch is necessary.
5. If a switch is required, select a compatible, host-confirmed patched branch and click Apply. Review the extensions for the selected branch. GreenGeeks documents Reset to default when no extensions are selected, but an application’s additional extensions still need checking.
6. Check every domain in that cPanel account. The selector is account-wide by default; sites or subdirectories can have custom handler overrides. Ask support to check those overrides rather than adding new .htaccess rules during the incident. GreenGeeks PHP selector guide

Confirm the fix

Changing a branch selects a host-installed runtime; it does not install a PHP security patch yourself. Require GreenGeeks evidence covering CVE-2026-109618 and CVE-2026-109619, the complete build/revision, and replacement of old serving workers. Upstream thresholds are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; a documented vendor backport can differ.

Recheck Site Health on each site and exercise login, forms, uploads and checkout where applicable. Record results using the change-record template.

If blocked or broken

Open a GreenGeeks support ticket with affected domains and ask for patch completion, override coverage and worker replacement evidence. Request exposure restriction if a fix is pending. Recover application compatibility using the backup or another patched runtime; if the prior PHP build is vulnerable, keep it isolated from public traffic. Follow the validation and rollback guide.

Fixed versions

Support request

Fill in the brackets and send it to GreenGeeks support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• GreenGeeks PHP selector guide greengeeks.com

Researched from GreenGeeks’s public documentation on 21 October 2026, 14:11 UTC, not inside a GreenGeeks account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that GreenGeeks has finished rolling out the patch for your site. Clarity Messaging is not affiliated with GreenGeeks.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · Namecheap · IONOS · WPX · Pantheon