Applies to Kinsta Managed WordPress in MyKinsta. Checked 21 October 2026, approximately 14:12 UTC. The general PHP update guide is not an incident-specific statement that the new CVE patches have reached your site.
Walkthrough
- Confirm a backup/recovery point. Select the staging environment to test any required PHP branch migration first.
- In MyKinsta, open Sites, select the site, and choose the intended environment.
- Open Tools. Under PHP settings, click Change.
- If support confirms your current branch contains both complete fixes, leave the branch unchanged. Otherwise choose a tested, compatible branch that Kinsta confirms is patched and confirm the change.
- Wait for the completion notification. Kinsta says this change restarts the PHP engine; do not interpret a restart without a patch as remediation.
- For multiple sites/environments, select them in Sites, then Actions → PHP settings → Change PHP settings. Review the selection carefully before applying a bulk change.
- If support specifically requests a manual PHP recycle after patching, use the site’s Tools → Restart PHP control. Official update/restart instructions
Verify or escalate
Record the full web PHP version in WordPress Tools → Site Health → Info → Server. Ask Kinsta for the complete build/backport revision fixing CVE-2026-109618 and CVE-2026-109619, rollout completion and worker replacement across all selected environments.
MyKinsta’s Automatic PHP Updates setting concerns moving a site when its branch reaches end of life. It is not a completion signal for this emergency release. For an LTS branch, require incident-specific backport evidence rather than judging only by its older version number.
Test login, forms, uploads, database-backed pages and checkout. Clear relevant caches when needed, but include a real dynamic request. If a branch change fails, request recovery on a compatible patched runtime; isolate any vulnerable fallback. If patching is pending, request an ETA/access restriction using the support request. See the shared checklist for common checks.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to Kinsta support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Official update/restart instructions kinsta.com
Researched from Kinsta’s public documentation on 21 October 2026, ~14:12 UTC, not inside a Kinsta account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Kinsta has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Kinsta.
Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon