Patch PHP on HostGator

Scope: HostGator Customer Portal or cPanel accounts with a PHP version selector. Checked 21 October 2026, approximately 14:12 UTC.

Patch status: The official instructions explain branch selection. Their general statements about security updates do not establish that your host has installed the 21 October fixes.

Walkthrough

1. Preserve a files/database backup, record the current PHP version and test any required branch change on staging.
2. Sign in to the Customer Portal and choose Websites.
3. Select Manage Site beside the intended website.
4. Open Advanced, find PHP Version, and select Change PHP Version.
5. Choose a supported branch whose current build HostGator confirms contains both patches. Click Apply and wait for the success notification.
6. Alternatively, in cPanel → Software → MultiPHP Manager, select the domain, choose the version and click Apply. Use one route; there is no need to apply both.
7. If the selected version does not take effect, ask support to check old PHP handler overrides. HostGator notes that older PHP Selector rules in .htaccess can interfere; do not delete unrelated rules blindly. HostGator official walkthrough

Verify the fix

In WordPress, open Tools → Site Health → Info → Server and record the full runtime version. The fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. For a vendor backport, retain HostGator’s full revision and explicit confirmation for CVE-2026-109618 and CVE-2026-109619. Ask whether old PHP workers have been replaced across all serving nodes. These incident checks are explained in the validation and rollback guide.

Test an uncached page, login, forms, media upload and checkout if relevant. Repeat for all hosted domains/subdomains.

If the build is unavailable or compatibility fails

Contact HostGator Support via its official chat/phone entry point with the domain, account and before/after version. Request patch completion evidence or ETA and an access restriction option. A missing MySQL extension or PHP error needs compatibility repair. If recovery requires older vulnerable PHP, keep the affected site isolated while support supplies a patched compatible build.

Fixed versions

Support request

Fill in the brackets and send it to HostGator support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• HostGator official walkthrough hostgator.com

Researched from HostGator’s public documentation on 21 October 2026, ~14:12 UTC, not inside a HostGator account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that HostGator has finished rolling out the patch for your site. Clarity Messaging is not affiliated with HostGator.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon