Scope: Nexcess Cloud managed WordPress/WooCommerce through the Nexcess Client Portal. Non-cloud SiteWorx and other Liquid Web products use different controls. Checked 21 October 2026, approximately 14:14 UTC.
Walkthrough
- Record the site’s current PHP version and confirm a fresh backup. Prepare a staging test if a branch change is needed.
- Sign in to the Nexcess Client Portal and open the managed hosting plan. Choose Sites, then click the relevant domain to open the site’s controls.
- Expand Show More if necessary and choose Management from the left menu. Under PHP, inspect the current version and binary path.
- Ask Nexcess whether that build already contains CVE-2026-109618 and CVE-2026-109619. If patched, a branch change may be unnecessary.
- If a change is required, click Change PHP version, choose the host-confirmed patched branch, run the available compatibility check, then click Update. Apply to staging first, test it, and repeat for production. The general control documentation is Nexcess’s Cloud PHP guide; despite its documentation path, the page states that the Cloud update process applies across platforms.
For a physical/non-cloud SiteWorx account, the verified alternative is SiteWorx → PHP Version → Update PHP Version dropdown → Select. That changes PHP for the account’s applications/commands, so assess its scope first. Source: Nexcess SiteWorx instructions.
Verify and recover
In WordPress, capture Tools → Site Health → Info → Server → PHP version. First fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports require written revision evidence. Confirm all serving workers/nodes are patched and old workers replaced. Test admin access, forms, uploads and any checkout flow.
The selector guide is not incident deployment confirmation. If the patched build is unavailable or unclear, open a Nexcess support ticket from the portal with the domains, full current version and both CVEs. Ask for completion time and access restrictions while pending.
If the switch breaks the site, recover with support on a patched compatible runtime. The normal “switch back” option can reintroduce exposure; isolate vulnerable rollback instances. Use the validation and rollback guide. No hosting account was accessed or changed.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to Nexcess / Liquid Web support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Nexcess's Cloud PHP guide docs.nexcess.com
- Nexcess SiteWorx instructions nexcess.net
Researched from Nexcess / Liquid Web’s public documentation on 21 October 2026, ~14:14 UTC, not inside a Nexcess / Liquid Web account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Nexcess / Liquid Web has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Nexcess / Liquid Web.
Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon