Patch PHP on Namecheap

Choose the correct product first. EasyWP managed WordPress and Namecheap’s cPanel shared plans have different controls. Official instructions checked 21 October 2026, 14:11 UTC; no incident rollout completion is inferred.

EasyWP managed WordPress

1. Record the domain/application and PHP version in WordPress Tools → Site Health → Info → Server. Preserve a current files/database backup.
2. Contact Namecheap support for the EasyWP application. The official FAQ says EasyWP does not provide cPanel or PHP access, so do not follow cPanel instructions for this product. EasyWP FAQ
3. Ask support to confirm the runtime build fixes CVE-2026-109618 and CVE-2026-109619, whether every serving node is covered, and whether old workers were replaced. Save the completion time or ETA.

Stellar / Stellar Plus cPanel plans

1. Back up and test any required branch migration on staging.
2. Open cPanel → Exclusive for Namecheap Customers → Select PHP Version. On some servers it is under Software.
3. Use Current PHP version, choose the host-confirmed patched compatible branch, then Apply. Check required extensions after switching. Addon-domain handler overrides may differ from the account setting; have support confirm their coverage. Shared hosting selector guide

Stellar Business / Business SSD

Open cPanel → Exclusive for Namecheap Customers → PHP Tweaks. Choose the domain, then adjust its PHP version. Domain-specific values take precedence over account settings. Allow several minutes and verify the effective runtime. Business hosting guide

Verify and recover

Selecting “8.3” is not proof of installing the patch. For upstream PHP, first fixed releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; require explicit vendor evidence for backports. Recheck Site Health for each domain and test login, forms, media upload and checkout. Retain support’s build/worker evidence.

If support cannot confirm remediation, request restriction of affected public PHP access. If a change breaks the application, restore compatibility on a patched runtime. A rollback to vulnerable PHP must remain isolated. VPS/dedicated server package updates require their own administrator workflow, not these shared-hosting selectors.

Fixed versions

Support request

Fill in the brackets and send it to Namecheap support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• EasyWP FAQ namecheap.com
• Shared hosting selector guide namecheap.com
• Business hosting guide namecheap.com

Researched from Namecheap’s public documentation on 21 October 2026, 14:11 UTC, not inside a Namecheap account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Namecheap has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Namecheap.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · IONOS · WPX · Pantheon