Patch PHP on Pressable

Scope: Existing sites on Pressable managed WordPress hosting. Checked 21 October 2026, approximately 14:13 UTC against official documentation. The controls below change a PHP branch; the documentation alone does not prove these incident patches have reached your site’s workers.

Walkthrough

1. Record the live site’s PHP version and take a fresh full backup. Have a recovery reference before making a branch change.
2. Sign in at my.pressable.com → Sites and choose the site. The site’s Overview shows its PHP version.
3. Ask Pressable to confirm whether the current branch’s installed build already contains CVE-2026-109618 and CVE-2026-109619. If it does, you may not need to change branches. Require a full build/revision and completion time, not only “PHP 8.3.”
4. If a branch change is necessary, clone the site to staging first. On the staging site’s dashboard, choose the target from the PHP Version dropdown. Pressable says the change applies immediately. Check the staging result before repeating on production.
5. On the live site’s dashboard, select the same tested, host-confirmed patched branch. Clear its edge/object caches and test the site. These panel steps follow Pressable’s PHP selector guide and PHP update FAQs.

Verify and recover

In WordPress, open Tools → Site Health → Info → Server and record the full PHP version. The first fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; a documented vendor backport can use another revision. Get confirmation that all serving workers were replaced. Test login, forms, media uploads and any checkout flow; a cached homepage does not prove the origin works.

Pressable’s account default PHP setting affects new sites, so it is not a repair for existing sites. For multiple sites, test a sample before using bulk operations, then verify each site’s result.

If patch coverage is unconfirmed, contact Pressable support with the domains and both CVEs. If the change breaks a site, request recovery on a patched compatible runtime. Keep any vulnerable rollback restricted from public traffic. Use the validation and rollback guide and change-record template. No account was accessed or updated to prepare this guide.

Fixed versions

Support request

Fill in the brackets and send it to Pressable support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• Pressable's PHP selector guide pressable.com
• PHP update FAQs pressable.com

Researched from Pressable’s public documentation on 21 October 2026, ~14:13 UTC, not inside a Pressable account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that Pressable has finished rolling out the patch for your site. Clarity Messaging is not affiliated with Pressable.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon