What to Ask Your Web Host About the PHP Security Fix

Key takeaways

• Ask for confirmation, not reassurance. A host that says "we are on it" has not told you a version or a date.
• A version number alone can mislead. Vendors of Linux distributions and extended support got the patches early, per php.net, so a fixed PHP can still wear its old version label.
• Name the CVEs. The two flaws are CVE-2026-109618 and CVE-2026-109619, and a reply should say which fixed release you now run.
• Hosts may already be working on it. WordPress.org notes that a host could already be moving PHP forward and adding web application firewall rules, yet it still wants owners to verify.
• Ask about old PHP. The PHP project ships nothing for 8.1 and earlier, so find out how the host treats accounts on those versions.
• Get it in writing. An email gives you a record and a date to follow up on.

Why asking is the right first move

PHP runs on the server that your host controls. According to php.net, every PHP installation that serves web requests is at risk. WordPress.org advises owners to look for updates from their host and, where needed, raise the PHP version on their own. On shared and managed hosting the host usually holds the switch, so your job is to make sure someone has used it.

The NCSC gives a second reason. Its advice is to list every system running PHP, starting with the ones facing the internet, and to count products that ship PHP inside them. For a small business, that means asking about every site and tool you pay for, not only the main website.

The questions

Copy the ones that fit your setup.

A message you can paste

Hello, Following the PHP security release of 21 October 2026 (CVE-2026-109618 and CVE-2026-109619), could you answer three points about my account [domain name]: 1. Which PHP version and patch level my site is on at the moment. 2. Whether the fix is applied, and the date. If not yet, the date you expect. 3. If it will not be applied by backport or update, what you advise. If you offer a newer PHP in the control panel, please tell me how to switch, and whether I can switch back. Thank you.

Short and specific works better than a long worried message. It also gives the support person one thing to answer.

How to read the answer

If you manage the server yourself

php.net lists temporary measures for people who cannot update at once, including memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. It also says that these only reduce exposure and that the update is the complete fix. The caveats are laid out in our main guide to the PHP vulnerability of October 2026. On WordPress, our walkthrough on how to check and update your PHP version will help.

What a good host relationship looks like

A host that answers in the first day, names versions, and tells you where to click to switch PHP is a good sign for the next advisory too. A reply that does not say which version you are on is a reason to keep asking. Weigh the price of one bad week against the price of better hosting. Our guide to website maintenance costs lists hosting and updates next to the other regular bills. Related reading: who patches PHP, Cloudflare's free WAF and Webflow security.

Keep reading on PHP: who is responsible for PHP updates, whether WordPress updates PHP automatically, how to back up WordPress before a PHP update.

How we help

Here at Amariq, the domain, hosting and analytics accounts stay in your name. That means you can put questions straight to the host, with no go-between. We can read the reply with you, test the site after a PHP change, and look after updates through Webflow maintenance or WordPress care. Ready to stop depending on PHP hosting? Webflow migration carries the site over with its URLs. When a host cannot do the update for you, an outside helper can: see who to hire and what to ask them.

Frequently asked questions

Should I contact my host or fix PHP myself?

Contact the host first, because PHP is installed on their server. WordPress.org suggests some hosts are already moving PHP forward, and still asks owners to look for themselves and update where they can.

How do I find out which PHP version my host runs?

Inside WordPress, open Tools, Site Health, Info and then Server. Many hosts also show it in the control panel. Ask them for the patch level too, such as 8.3.36.

Is a firewall rule enough?

No. WordPress.org says hosts may put web application firewall rules in place, and still tells owners to update PHP. PHP's own advisory says the update is the only complete fix.

What if my host will not update?

Ask for a written reason and a date. If your PHP is older than 8.2, WordPress.org's note for self-managed servers is to consider taking the site offline during the update. A host that keeps PHP current may be worth moving to.

What if the host says it was already patched in advance?

That can be true, since distribution and support vendors were sent the patches ahead of release. Ask for the package or version and the date, and compare it with your dashboard.

Does this apply to Webflow, Shopify or Wix?

On hosted builders the servers belong to the vendor, so there is no PHP version for you to change. In its Trust Center notice dated 21 October 2026, Webflow calls its core services unaffected. We found no statement from Shopify, Wix, Squarespace or Framer, so put the question to them.

What should I do if I think my site was hacked?

The NCSC wants you to hunt for signs of compromise and hidden backdoors, and to bring in an incident response provider if you are unsure. WordPress.org has an FAQ called "My site was hacked" for WordPress owners.