Has A2 Hosting (now Hosting.com) patched the October 2026 PHP vulnerability?
Says it has patched
A2 Hosting (now Hosting.com) has publicly stated that it patched PHP for CVE-2026-109618 and CVE-2026-109619, on 21 October 2026.
“With help from our vendors, every server we manage was updated.”
What A2 Hosting (now Hosting.com) says you should do
Nothing on a managed plan. On unmanaged plans with root access they say you must apply the update yourself, because they cannot do it for you.
A2 Hosting rebranded to Hosting.com, and a2hosting.com now redirects there — this statement is published under the Hosting.com name. Their status page separately confirms the update completed on 22 October.
How to check your own site, whatever your host has said
A host’s announcement covers their fleet. The only thing that tells you about your site is your site. In WordPress:
- Log in to WordPress.
- Go to Tools → Site Health.
- Open the Info tab.
- Expand Server. PHP version is the first line.
The fix shipped in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A version below those does not automatically mean you are exposed — hosts and Linux distributions routinely apply the patch without changing the version number.
Check what your site reports
We load your homepage once and read what it publishes. Most servers hide their PHP version, which is correct of them — so this often comes back empty, and the result tells you where to look instead.
No signup. We load your homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on your site is touched.
Common questions
Has A2 Hosting (now Hosting.com) patched CVE-2026-109618?
A2 Hosting (now Hosting.com) has publicly stated that it patched PHP for this issue, in a statement dated 21 October 2026. Their own page is linked on this page so you can read the wording yourself.
How do I check what PHP version my A2 Hosting (now Hosting.com) site is running?
In WordPress, go to Tools → Site Health → Info → Server. The PHP version is the first line, and you need no cPanel, FTP or SSH access for it. Most hosts also show the PHP version somewhere in their own control panel, and let you change it there.
My site reports a PHP version below the fix. Does that mean it is vulnerable?
Not necessarily. Hosts and CloudLinux routinely apply security patches to older releases without changing the version number, so a server can report an older version and already have the fix. The version string records what was printed, not what was patched. Your host's support can confirm it definitively.
Other hosts
This page records what A2 Hosting (now Hosting.com) has published, not our own assessment of their infrastructure. We cannot see inside any host. Last checked — if A2 Hosting (now Hosting.com) has published something since, their own site is the authority.