Patch PHP on InMotion Hosting

Scope: Shared, reseller and cPanel-based WordPress hosting. Managed VPS/dedicated accounts may also require server-level PHP installation by an administrator or support. Checked 21 October 2026, approximately 14:14 UTC.

Walkthrough

1. Record the domains and PHP versions. Confirm a current backup and test a needed branch migration on staging before applying it to the live site.
2. Sign in to the site’s cPanel. Under Software, open MultiPHP Manager. Use the manager for version selection; MultiPHP INI Editor changes settings and does not install a security-fixed runtime.
3. Inspect the domains and their assigned PHP versions. Ask InMotion whether the installed build for the current branch already contains both incident fixes. If it does, a branch change may not be required.
4. Where a switch is necessary, check the box for the intended domain or domains, select the host-confirmed patched branch from PHP Version, and click Apply. Review every selected domain before applying. These controls are documented in InMotion’s cPanel PHP guide.
5. If the patched branch/build is unavailable, contact InMotion support. Shared customers cannot install server packages themselves. VPS/dedicated customers should request or perform the server update through their established managed-server procedure, not merely select an old installed branch.

Verify and recover

Open WordPress → Tools → Site Health → Info → Server and record the full PHP version for every site. Upstream fixed versions start at 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. If InMotion uses a vendor backport, obtain its full package revision and explicit evidence covering CVE-2026-109618 and CVE-2026-109619. Confirm replacement of old PHP workers across affected domains/nodes.

Test login, forms, media uploads and any checkout flow. Save results and support confirmation in your change record. A branch label or successful cached page is not proof of remediation.

If coverage remains uncertain, request the patched build, completion ETA and an access restriction route. If compatibility fails after changing PHP, involve support and recover on a patched compatible runtime. Restrict any vulnerable rollback from public traffic until fixed; follow the validation and rollback guide.

The official selector article describes general controls, not today’s patch rollout. No account was accessed or updated.

Fixed versions

Support request

Fill in the brackets and send it to InMotion Hosting support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• InMotion's cPanel PHP guide inmotionhosting.com

Researched from InMotion Hosting’s public documentation on 21 October 2026, ~14:14 UTC, not inside a InMotion Hosting account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that InMotion Hosting has finished rolling out the patch for your site. Clarity Messaging is not affiliated with InMotion Hosting.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon