Applies to WP Engine WordPress environments in the User Portal. Checked 21 October 2026, approximately 14:12 UTC. These are verified PHP-selector instructions; a general automatic-upgrade policy does not prove today’s CVE patches are deployed.
Walkthrough
- Record a current backup and identify production, staging and development environments. Test a required branch change on staging/development first.
- In the User Portal, open Sites and select the environment name.
- On the environment overview, find Updates → PHP.
- Click the PHP version number to open the selector.
- Keep the current branch if WP Engine confirms it already contains both complete fixes. If a branch migration is necessary, select a tested, compatible branch that support confirms is patched, then Confirm.
- Repeat for each environment. WP Engine documents PHP version as an environment setting; copying an environment does not copy its PHP version.
- Optionally use Preview PHP before a branch migration to inspect compatibility, but do not treat a preview session as a production runtime deployment. Official PHP guide
Verify the actual runtime
Use WordPress Tools → Site Health → Info → Server to record the complete web PHP version. Ask WP Engine support for the full patched build or vendor backport revision covering CVE-2026-109618 and CVE-2026-109619, plus coverage of serving nodes and replacement of affected workers.
The first fixed upstream releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A panel’s “8.4” label, an automatic end-of-life upgrade policy or a preview cookie cannot establish this incident’s patch status. Do not deploy a public phpinfo page just to check the version.
Test dynamic pages, login, forms/uploads and checkout as appropriate. If the site fails, ask support to restore service on a compatible patched runtime; isolate any vulnerable fallback. If the needed patch is unavailable, request an ETA and exposure restriction. Use the shared support request and completion checklist.
Fixed versions
| PHP branch | First fixed release | Security support ends |
|---|---|---|
| 8.2 | 8.2.35 or later | 31 December 2026 |
| 8.3 | 8.3.36 or later | 2027 |
| 8.4 | 8.4.27 or later | 2028 |
| 8.5 | 8.5.12 or later | 2029 |
Vendor backports may keep an older version number. Require the complete revision and written coverage of both CVEs. Sources: PHP release, supported versions.
Support request
Fill in the brackets and send it to WP Engine support. Ask for a written answer and keep it in your change record.
Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619 Please confirm the status for these managed WordPress sites: - Hosting account: [account reference] - Domains, including staging: [list] PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide: - The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs. - Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced. - The completion time, or a concrete ETA if still pending. - Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly. Please also confirm the available backup/recovery path before any PHP branch change.
Sources
- Official PHP guide wpengine.com
Researched from WP Engine’s public documentation on 21 October 2026, ~14:12 UTC, not inside a WP Engine account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that WP Engine has finished rolling out the patch for your site. Clarity Messaging is not affiliated with WP Engine.
Other hosts: SiteGround · GoDaddy · Flywheel · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · WPX · Pantheon