Scope: Sites actually hosted on WordPress.com, not independently hosted WordPress installations. Checked 21 October 2026, approximately 14:13 UTC. Some server controls depend on the site’s plan.
WordPress.com says it handles required PHP updates for hosted sites. Treat that as the service’s general policy, not confirmation that a particular site’s workers already contain both incident fixes. Source: WordPress.com server settings.
Walkthrough
- Record the site URL, plan and current PHP version. Confirm a recent backup/recovery route; use staging before a necessary branch change.
- Open the Hosting Dashboard, select the site’s title, choose Settings, then scroll to Server.
- Open PHP and record the selected version. If WordPress.com has patched the existing branch, leave it in place rather than switching merely to force an update.
- If support confirms a different available branch is required, select it from the PHP dropdown and click Save. Test the change on staging where available before repeating on the live site. These are the verified controls in the official server-settings guide.
- If the PHP control is absent, use WordPress.com support. Do not purchase a higher plan solely to obtain an emergency PHP patch: request confirmation of the platform’s runtime remediation for your current site.
Verify and recover
Where available in WordPress admin, use Tools → Site Health → Info → Server to capture the actual web PHP version. If the plan does not expose this view, request the build and remediation evidence from support. Upstream thresholds are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Ask for explicit coverage of CVE-2026-109618 and CVE-2026-109619, all serving nodes, worker replacement and completion time. A selector showing only a branch is insufficient.
Exercise login, editing, forms, uploads and commerce flows. Check a dynamic route rather than relying on a cached homepage. Keep evidence in your change record.
WordPress.com does not provide arbitrary server configuration changes; do not try to deploy source archives or a plugin as the PHP runtime fix. If compatibility breaks, involve support and recover on a patched runtime. If recovery temporarily requires vulnerable PHP, restrict public access until repaired. Follow the validation and rollback guide.
Additional official reference: WordPress.com server environment. No account was accessed or changed.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to WordPress.com support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- WordPress.com server settings wordpress.com
- WordPress.com server environment wordpress.com
Researched from WordPress.com’s public documentation on 21 October 2026, ~14:13 UTC, not inside a WordPress.com account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that WordPress.com has finished rolling out the patch for your site. Clarity Messaging is not affiliated with WordPress.com.
Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon