On 21 October 2026, the PHP project released fixes for two serious security flaws in PHP, the language WordPress runs on (CVE-2026-109618 and CVE-2026-109619).
Patching is complete. The official fixes are now installed on every WPCloud server, for current and older PHP versions alike, and we have checked each server. Your site is patched.
There is nothing you need to do. You don’t need to open a ticket, change your PHP version, update WordPress or take a backup.
Every server was protected from early on 21 October, before the official fix was released. Our monitoring found no sign that any attack attempt succeeded on our servers. If we ever find anything that affects your site, we will contact you directly.
If your IT department, insurer or auditor needs written confirmation, open a support ticket and let us know who it is for.
A thank you, and a small request. This was a long day for our system administrators and our support team. Our sysadmins worked from early morning until late at night to protect and patch every server, and our support team answered a very large number of tickets while that work went on. Whenever you contact our support team, please remember that a real person is reading your message and working to help you. Patience and kindness go a long way, and we thank everyone who showed both today.
Full details, including common questions: Critical PHP security release, 21 October 2026: what WPCloud clients need to know
The WPCloud Team
srijeda, listopad 21, 2026
