On 21 October 2026, the PHP project disclosed two critical security flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. They could let an attacker run their own code on a website without logging in.
PHP powers most websites, including WordPress, WooCommerce, Joomla and many custom sites. So we acted straight away.
What we have done
- Patched PHP on our servers. We installed the fixed PHP packages for every PHP version we offer, both cPanel’s PHP and CloudLinux’s PHP, and restarted PHP so the fix is active. completed on 22 October 2026.]
- Blocked known attacks. Our Imunify360 web application firewall blocks the known attack patterns against these flaws on WordPress and e-com hosting packages, and its rules update automatically.
For most customers, there is nothing you need to do. If you would like to confirm for yourself, or your site runs an old PHP version, follow the steps below.
How to check your website
We have published a free, open-source check script on GitHub: lankahost-php-patch-check. It needs no technical knowledge and no special access, and it takes about two minutes.
Step 1: Download the script
Download check-php-patch.php to your computer. If your browser opens it as text, right-click the link and choose Save link as.
Step 2: Upload it to your website
- Log in to cPanel.
- Open File Manager.
- Go to your website’s folder. For your main domain this is usually
public_html. - Click Upload and choose
check-php-patch.php. - Rename the file to something hard to guess, for example
check-8f3k2.php.
Step 3: Open it in your browser
Visit the file’s address, for example:
https://yourdomain.com/check-8f3k2.phpThe page shows your result at the top, along with your PHP version, PHP type and build date.
Step 4: Delete the file
Go back to File Manager and delete the file straight away. It is meant for a one-time check only and should not stay on a live website.
If you have more than one website in your account, repeat these steps in each website’s folder. Different sites can use different PHP versions.
What your result means
| Result | What it means | What to do |
|---|---|---|
| PATCHED | Your PHP version includes the fix | Nothing |
| LIKELY PATCHED | Your PHP received the fix as a backport, so the version number did not change, but the build date confirms the update | Nothing |
| NOT PATCHED | Your PHP was built before the fix | Contact our support team |
| UNKNOWN | The script could not read the build date | Contact our support team |
When you contact us, include your domain name, the PHP version and the build date shown by the script. Please do not leave the file on your site for us to view.
Running an old PHP version? Time to upgrade
If your site runs PHP 8.1 or older (for example 7.4 or 8.0), the script shows a recommendation to upgrade. These versions are end of life and no longer receive official security updates from the PHP project. We have patched them for this issue, but future flaws may not be fixable.
PHP 8.2 receives security updates only until 31 December 2026, so plan your move now.
We recommend PHP 8.3 or 8.4. To switch:
- Take a backup of your website in cPanel first.
- In cPanel, open Select PHP Version (or MultiPHP Manager).
- Choose PHP 8.3 or 8.4 and save.
- Visit your website and check the main pages, forms and checkout still work.
- If something breaks, switch back to your previous version and contact us. Often an outdated plugin or theme needs updating first.
For WordPress sites, update WordPress, your plugins and your theme before switching PHP version.
Frequently asked questions
Do I need to do anything?
No. We have patched our servers. The check is optional, for peace of mind.
Is the script safe to use?
Yes. It is open source, so you can read every line on GitHub. It only reads your PHP version details and changes nothing. It shows a minimal set of information, but please still delete it after use.
Was my website hacked?
We have no indication that customer websites were affected. If you notice anything unusual, such as unknown files, new admin users or unexpected redirects, contact us straight away.
I use a VPS or dedicated server that I manage myself. Is it patched?
Self-managed servers are your responsibility. Update PHP with yum update or dnf update, then restart Apache and PHP-FPM. The README on GitHub includes commands to check every installed PHP version. Contact us if you would like our team to do it for you.
Need help?
Our support team is happy to check your website for you or help you upgrade PHP.
https://manage.lankahost.net/supporttickets.php
LankaHost Web Solutions (Private) Limited ยท www.lankahost.lk
