Patch PHP on IONOS

Applies to: IONOS Managed Hosting for WordPress, plus the separate Linux Web Hosting control-panel route. Official documentation checked 21 October 2026, 14:11 UTC. General update policies do not prove today’s patches are installed.

Managed Hosting for WordPress

1. Record the contract, project, domains and PHP version from WordPress Tools → Site Health → Info → Server. Preserve a backup reference and identify a staging/testing option.
2. Ask IONOS to confirm the runtime update for both CVE-2026-109618 and CVE-2026-109619. IONOS explicitly says it manages PHP versions for this product and customers cannot change them. Do not convert the project to self-managed WordPress simply to expose a selector. IONOS managed-version distinction
3. Obtain the complete build/revision, serving-node coverage, old-worker replacement status and completion time. Recheck Site Health and functional flows afterward.

Self-managed WordPress on Linux Web Hosting

1. Back up files/database and check theme/plugin compatibility before a branch change. IONOS WordPress preparation guide
2. Sign in to IONOS. Open Menu → Hosting, then choose the correct contract if prompted.
3. In the PHP tile, click Manage. Locate the domain in the PHP settings table.
4. Click the domain, choose the compatible, host-confirmed patched PHP branch and click Save. For several domains, the documented option is their checkboxes followed by Select PHP version. Wait for activation and verify each domain. IONOS control-panel instructions

Verification and escalation

The same “8.4” label can represent different patch builds. First fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports need explicit evidence covering both CVEs. “Extended Support” alone is not proof of this fix.

Test login, forms, uploads and checkout, and save build/worker confirmation in your change record. If remediation cannot be confirmed, contact IONOS support and request an ETA and exposure restriction. For recovery, prefer the previous application release on patched PHP. Keep any vulnerable runtime rollback isolated from public traffic while compatibility is repaired.

Fixed versions

Support request

Fill in the brackets and send it to IONOS support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• IONOS managed-version distinction ionos.com
• IONOS WordPress preparation guide ionos.com

Researched from IONOS’s public documentation on 21 October 2026, 14:11 UTC, not inside a IONOS account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that IONOS has finished rolling out the patch for your site. Clarity Messaging is not affiliated with IONOS.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · WPX · Pantheon