Critical PHP Vulnerabilities: What Website Owners Need to Know
On October 21, 2026, the PHP project released emergency security fixes for two critical vulnerabilities in the PHP language itself: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. Because PHP powers WordPress and a large share of the web, this affects nearly every hosting platform, including ours. This post explains what happened, what we have done about it, and what, if anything, you need to do.
What the vulnerabilities are
Both flaws are remote code execution vulnerabilities. In plain terms, they could allow an attacker to run their own code on a web server over the internet, without logging in. The PHP team published fixed versions the same day: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Attempts to exploit the flaws have already been reported, which is why hosting providers moved quickly.
What we have done
Protective measures were put in place across our shared hosting platform as soon as the issue was announced, ahead of the official fix, and the patched PHP versions are now rolling out. While that rollout completes over the next few days, some larger operations are temporarily limited: large uploads and form submissions, big imports, backup restores and migrations, and some theme and plugin installs. These limits are deliberate and temporary; they keep the platform protected while the permanent fix lands. Live progress is posted on our network status page.
What you need to do
If your site is hosted with InterProWebHost on a shared or managed plan: nothing. The protection and the updates are handled at the server level, and most sites will notice no change at all.
If you run an unmanaged VPS or dedicated server with us, please update PHP to one of the fixed versions listed above through your normal package updates as soon as you can.
If your site is hosted elsewhere, ask your provider two questions: have the protective measures been applied, and when will the patched PHP versions be in place? A provider should be able to answer both on the day. If they cannot, that tells you something worth knowing before renewal time.
Frequently asked questions
Is my website affected?
The vulnerabilities are in the PHP runtime, not in your website’s code, theme, or plugins. Any site running an unpatched PHP version is exposed at the server level, which is why the fix belongs to the hosting platform rather than to site owners.
Do I need to update WordPress or my plugins because of this?
No. This issue is fixed by updating PHP itself, which your host manages on shared and managed plans. Keeping WordPress and plugins current remains good practice for separate reasons.
How long will the temporary limits last?
A few days, while the patched versions finish rolling out across the platform. Our network status page carries the live entry and will be marked resolved when the work is complete.
Keeping your sites protected is the job. When the whole web has a day like this, you should hear about it from your host first, in plain language, with the work already underway.
