Patch PHP on WPX

Applies to: WordPress, Agency and WooCommerce hosting using the WPX Control Panel. This is WPX at wpx.net, not the unrelated Japanese wpX service. Official instructions checked 21 October 2026, 14:11 UTC. They establish the panel path, not incident patch completion.

Walkthrough

1. Record the site’s current PHP version under WordPress Tools → Site Health → Info → Server. Preserve a files/database backup and test any branch migration on a staging copy when available.
2. Sign in to the WPX account. Locate the correct hosting plan and click its Control Panel button. If the plan is not on the account homepage, use the relevant WordPress Hosting, Agency Hosting or WooCommerce Hosting tab.
3. Open the PHP section and select the website you intend to change.
4. Review the available branches. Ask WPX to confirm that the desired installed build fixes both incident CVEs. If your existing build is already fixed, an unnecessary branch change adds compatibility risk.
5. When a switch is necessary, choose the confirmed compatible PHP version and click Save Changes. Repeat for other websites and staging environments. WPX PHP version walkthrough

Confirm the runtime patch

The control panel chooses a WPX-installed runtime; it does not let you install an arbitrary PHP patch version. Require support evidence for CVE-2026-109618 and CVE-2026-109619, including the exact build/revision, coverage of serving nodes and replacement of old PHP workers. First fixed upstream releases are 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Do not treat a branch-only label or a WAF claim as complete proof.

Recheck WordPress Site Health and test dynamic login/session behavior, forms, media upload and checkout. A cached homepage is insufficient. Record the version and support response in the change-record template.

If blocked or broken

WPX documents a support live-chat widget at the bottom right of its pages. Ask for patch status, a concrete ETA and an option to restrict affected public PHP access. If compatibility fails, restore the app or move to another patched compatible runtime. If the previous PHP runtime is vulnerable, keep it isolated during recovery. Use the validation and rollback guide for the full checklist.

Fixed versions

Support request

Fill in the brackets and send it to WPX support. Ask for a written answer and keep it in your change record.

Subject: Urgent: confirm PHP patches for CVE-2026-109618 / CVE-2026-109619

Please confirm the status for these managed WordPress sites:

- Hosting account: [account reference]
- Domains, including staging: [list]

PHP's 21 October 2026 security release fixes CVE-2026-109618 and CVE-2026-109619. Please provide:

- The complete installed PHP version/build or vendor revision and evidence that it fixes both CVEs.
- Confirmation that the update covers every serving node/PHP handler for these sites and that old workers have been replaced.
- The completion time, or a concrete ETA if still pending.
- Any site-owner action needed, and an access restriction option if the runtime cannot be patched promptly.

Please also confirm the available backup/recovery path before any PHP branch change.

Sources

• WPX PHP version walkthrough wpx.net

Researched from WPX’s public documentation on 21 October 2026, 14:11 UTC, not inside a WPX account. Menu labels can vary by plan, region or dashboard revision. A citation verifies the documented procedure, not that WPX has finished rolling out the patch for your site. Clarity Messaging is not affiliated with WPX.

Other hosts: SiteGround · GoDaddy · Flywheel · WP Engine · Kinsta · Bluehost · Hostinger · HostGator · DreamHost / DreamPress · Cloudways · Pressable · WordPress.com · Nexcess / Liquid Web · InMotion Hosting · hosting.com / former A2 Hosting · GreenGeeks · Namecheap · IONOS · Pantheon