Which hosts have patched the October 2026 PHP vulnerability?
What each host has publicly said about CVE-2026-109618 and CVE-2026-109619 — quoted from their own pages, with dates and links so you can check for yourself. Last gone through on .
Where a host has said nothing publicly, the row says exactly that. That is not evidence they have not patched — plenty do it quietly and never announce it. It means we found nothing to quote, and we would rather tell you that than guess on a company’s behalf.
| Host | What they have said | Dated |
|---|---|---|
| A2 Hosting (now Hosting.com) | Says it has patched | 21 October 2026 |
| Cloudways | Says it has patched | 22 October 2026 |
| DreamHost | Says it has patched | 23 October 2026 |
| Elementor Hosting | Says it has patched | 22 October 2026 |
| Flywheel | Says it has patched | 21 October 2026 |
| GoDaddy | Says it has patched | — |
| Hostinger | Says it has patched | 21 October 2026 |
| IONOS | Says it has patched | — |
| Kinsta | Says it has patched | 23 October 2026 |
| Namecheap | Says it has patched | 21 October 2026 |
| Pressable | Says it has patched | 21 October 2026 |
| SiteGround | Says it has patched | 21 October 2026 |
| WordPress VIP | Says it has patched | 21 October 2026 |
| WP Engine | Says it has patched | 22 October 2026 |
| Bluehost | Has acknowledged the issue | 21 October 2026 |
| HostGator | Has acknowledged the issue | 21 October 2026 |
| InMotion Hosting | Has acknowledged the issue | 22 October 2026 |
| Liquid Web | Has acknowledged the issue | 24 October 2026 |
| Nexcess | Has acknowledged the issue | 24 October 2026 |
| Rocket.net | Has acknowledged the issue | 22 October 2026 |
Why your host’s announcement is not the whole answer
A host patching their fleet covers the PHP they run. It does not tell you which PHP version your site is set to use — most hosts let you pick, and a site pinned to an old branch stays on it. So the announcement and your own site are two different questions.
Check yours in WordPress under Tools → Site Health → Info → Server, or with the PHP version checker.
This page records what each company has published, not our own assessment of their infrastructure — we cannot see inside any host. If a host has published something since 24 October 2026, their own site is the authority.