Patch PHP on hosting.com / former A2 Hosting

Scope: hosting.com accounts using cPanel’s PHP selector, including applicable former A2 accounts. Managed WordPress or other dashboard products may differ; if the controls do not match, use support rather than a guessed menu. Checked 21 October 2026, approximately 14:14 UTC.

Walkthrough

1. Record the domain, hosting product and current PHP version. Confirm a fresh backup and recovery path. Test a needed branch change on a staging copy first.
2. Open cPanel from the hosting client area. hosting.com’s official guide describes cPanel Login in the client area; legacy links may retain the A2 name.
3. In cPanel, find Select PHP Version / PHP Version. The guide shows the current PHP version at the top of the page and a Current PHP Version control for choosing another version.
4. Before switching, ask hosting.com whether the current branch’s build already fixes CVE-2026-109618 and CVE-2026-109619. If patched, retain that branch unless another change is necessary.
5. If a switch is required, select the tested, host-confirmed patched branch in that control and complete the page’s displayed confirmation. The exact apply-button wording was not established in the published guide; follow the live control or request support. Source: hosting.com cPanel guide, PHP section.

Verify and recover

In WordPress, check Tools → Site Health → Info → Server → PHP version. First fixed upstream versions are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. If the host supplies a backport, get the complete build/revision and evidence for both CVEs. Ask whether old PHP workers were replaced across all serving nodes; selecting “8.3” alone proves neither patch availability nor deployment.

Test login, forms, media uploads and checkout where relevant. Keep the host’s confirmation, completion time, before/after version and test results in your change record.

For an unfamiliar product dashboard or missing fixed build, contact hosting.com support with the domains and both CVEs. Ask for a safe exposure restriction while waiting. If compatibility breaks, recover with support on patched PHP; keep a vulnerable rollback isolated until repaired. Follow the validation and rollback guide.

The linked general PHP controls are not a claim that hosting.com’s incident patch deployment is complete. No account was accessed or changed.

Fixed versions

Support request

Fill in the brackets and send it to hosting.com / former A2 Hosting support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• hosting.com cPanel guide, PHP section hosting.com

Researched from hosting.com / former A2 Hosting’s public documentation on 21 October 2026, ~14:14 UTC, not inside a hosting.com / former A2 Hosting account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that hosting.com / former A2 Hosting has finished rolling out the patch for your site. Clarity Messaging is not affiliated with hosting.com / former A2 Hosting.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon