Applies to WordPress sites managed through Site Tools. Checked 21 October 2026, approximately 14:12 UTC. No customer account was accessed.
Incident status
SiteGround’s release-day announcement says it applied server-level protective measures automatically and that customers need not switch versions. The captured announcement was last updated 11:30 UTC, before the PHP release. Treat that as a mitigation statement, not proof that the complete released patches are installed on your account. Ask SiteGround to confirm its final patched build for both CVEs. Incident announcement
Walkthrough
- Record the site’s PHP version in WordPress Tools → Site Health → Info → Server. Confirm your backup and staging/recovery options.
- In the SiteGround account, open Websites, choose the site, then Site Tools.
- Open Devs → PHP Manager → PHP Version. Record the displayed version and management mode.
- If support confirms the current branch is fully patched, keep it; no branch change is needed. If a compatible branch change is required, test it on staging first.
- Use the pencil Change PHP version control. Choose the appropriate managed/manual setting and the host-confirmed patched branch, then Confirm. Do not disable managed updates merely to respond to this incident.
- For Standard PHP setups, inspect Select Domain for subdomain coverage; inspect Staging Sites separately. A production change does not establish every environment’s status. PHP management instructions
Finish or escalate
Ask support for the complete build/revision covering CVE-2026-109618 and CVE-2026-109619, rollout completion across serving nodes and worker replacement. Use the support request.
Recheck Site Health and test login, forms, upload and checkout where applicable. Save the confirmation in your change record. If the site fails after a branch change, request recovery on a compatible patched runtime; isolate any vulnerable rollback. If patching is pending, ask the host for an ETA and a way to restrict origin access. See the shared completion checklist.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to SiteGround support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Incident announcement siteground.com
- PHP management instructions siteground.com
Researched from SiteGround’s public documentation on 21 October 2026, ~14:12 UTC, not inside a SiteGround account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that SiteGround has finished rolling out the patch for your site. Clarity Messaging is not affiliated with SiteGround.
Other hosts: GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon