Patch PHP on Hostinger

Scope: Hostinger web/cloud hosting managed through hPanel. VPS administration and Hostinger AI Builder are different routes. Checked 21 October 2026, approximately 14:12 UTC.

Patch status: Hostinger’s general PHP article establishes menu navigation, not completed patching for these CVEs. Ask support for the actual build serving your account.

Walkthrough

1. Back up files/database and record the existing web PHP version. Identify every site on the hosting plan before changing settings; test a needed branch migration on staging.
2. Sign in to hPanel and open Websites.
3. Beside the relevant site, choose Dashboard.
4. Find PHP Configuration in the site’s dashboard/sidebar.
5. Select a supported PHP branch whose current Hostinger build is confirmed fixed, then click Update. Hostinger says the change takes a couple of minutes.
6. Check every website on that hosting plan. The official article says this selection applies to all plan websites except AI Builder sites. Do not assume a staging branch change is isolated from production. If you need per-site isolation, ask support for the appropriate account-specific route before applying a change. Hostinger PHP configuration instructions

Verify and retain evidence

For each WordPress site, open Tools → Site Health → Info → Server. Record the full version, not merely the hPanel branch. Upstream PHP must be 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or a later stable release in the same branch; a vendor backport needs explicit evidence covering both CVE-2026-109618 and CVE-2026-109619. Ask Hostinger to confirm the build and recycling of all serving PHP workers. See the validation and rollback guide.

Test dynamic pages, login, forms, upload and any checkout on every affected site. Save the results and support response.

If you cannot confirm remediation

Contact Hostinger Support with the plan ID, domains and current PHP version. Request the patched build/revision, rollout status/ETA and a way to restrict origin access while pending. Do not force legacy PHP through .htaccess as a security repair. If a change fails, recover on a compatible patched runtime; isolate any temporary vulnerable rollback from public traffic.

Fixed versions

Support request

Fill in the brackets and send it to Hostinger support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• Hostinger PHP configuration instructions hostinger.com

Researched from Hostinger’s public documentation on 21 October 2026, ~14:12 UTC, not inside a Hostinger account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Hostinger has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Hostinger.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon