Your WordPress host says mitigations are in place: what to ask next
Mitigations are interim protection, and PHP says updating is the only safe choice. What your host's reply means, and the follow-up that gets a date.
When the company you pay to keep your website online says "mitigations in place," it means they've put protection in front of the two bugs fixed on October 21, 2026 in PHP, the software WordPress runs on behind the scenes. The actual fix is still on its way, and PHP's own advisory says "There are no complete mitigations, updating is the only safe choice." So the reply is good to hear for now, and your next question is the date the fix lands, in writing.
That company is your host: GoDaddy, Bluehost, SiteGround and so on. They look after PHP on your server, the computer your website lives on.
What does "mitigations in place" mean?
A mitigation makes a problem harder to reach without removing it. As of October 21, hosts were describing three kinds:
-
Firewall rules. A firewall is a filter in front of your site that blocks bad traffic. Kinsta described adding extra Cloudflare protections (Kinsta community), and WordPress.org says your host "may already be working to update PHP and put web application firewall (WAF) rules in place" (WordPress.org, October 21, 2026).
-
Setting changes on the server. Cloudways described "interim configuration-level mitigations" (Cloudways status). PHP published temporary settings for anyone who can't update right away, and says they "reduce exposure to specific attack paths but do not make an installation safe" (php.net).
-
Switching off the affected features, which SiteGround describes doing (SiteGround).
None of these is the update. The same WordPress.org post says you "should still check for updates from your web host."
How is interim protection different from the fix?
| Interim protection | The fix | |
|---|---|---|
| What it is | Firewall rules, setting changes, features switched off | PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a fix your host backports to an older version |
| What PHP says | Its temporary settings "do not make an installation safe" | "updating is the only safe choice" |
| How long it lasts | Until the fix is installed | It stays |
| What you ask for | A date for the fix | Written confirmation for your website |
The version numbers matter because they're how you'll recognize the fix in your host's reply (php.net). Some hosts patch PHP without changing the version number your website shows, so if yours backports the fix, ask them to say so in words (Wordfence).
What have hosts said so far?
These come from each host's own page, as read on October 21, 2026. They change by the hour, so re-check with your host.
| Host | What its own page said | Source |
|---|---|---|
| GoDaddy | Managed Hosting for WordPress: "We have patched all PHP versions." Web Hosting and Windows Hosting: mitigations in place while GoDaddy waits for its vendor's patched packages (update at 19:30 UTC) | GoDaddy |
| Kinsta | A temporary configuration change and extra Cloudflare protections, with patched PHP to be deployed once validated | Kinsta community |
| SiteGround | Server-level mitigation rules on all servers and the affected features disabled (page last updated 11:30 UTC, before PHP's release) | SiteGround |
| Cloudways | Interim configuration-level mitigations deployed across its servers, with official patches rolling out in phases (update at 22:19 UTC) | Cloudways status |
| Hostinger | Extra protection added, with patched PHP rolling out | Hostinger status |
Many hosts aren't listed because we found no statement from them. That isn't a sign either way, so ask yours.
Does "no action needed" mean you're covered?
Not by itself. GoDaddy's page shows why. For Web Hosting and Windows Hosting, it says mitigations are in place and that the fix will follow "as soon as our vendor supplies patched packages," and then: "You don't need to take any action" (GoDaddy, as of October 21, 2026). So you don't have to change anything, and the fix itself is still on its way. Read "no action needed" as "you don't have to change any settings," and keep asking for the date.
Why get the date in writing?
Some hosts patch PHP without changing the version number your website shows (Wordfence). You can't confirm the fix by looking, so a written answer is the check you have.
A date also gives you something to plan around. If it slips, their written reply shows what was promised, and you can follow up with that in hand.
If your host can't give a date, that tells you something too. The NSA's advice for a system that can't be updated right away is this: "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated" (NSA, "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities," October 21, 2026). For a heating and air shop in late October, that's the week the phones start ringing. A firm date from your host keeps that question off your desk. If you can't get one, ask your web company what your options are.
What should you send next?
Subject: Follow-up: date for the PHP fix on [yourdomain.com]
Hello, thank you for confirming that mitigations are in place for CVE-2026-109618 and CVE-2026-109619. Please tell me, in writing:
The date the fixed PHP version will be installed for [yourdomain.com].
Which PHP version my website will be on afterward, and whether it is 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a backported fix.
How you'll let me know it's done, or which status page I should watch.
If my website is on PHP 8.1 or older, whether the fix covers my version or I need to move to 8.3 or newer.
Thank you.
The two CVE numbers are the official IDs for these bugs, so your host knows exactly which fix you mean. Send it as a support ticket if your host has a ticket system, so there's a record with a number on it. If a day goes by with no answer, send it again and ask for a manager. Other messages, including one for a web company, are on our WordPress advisory page.
Where does The Graphite Lab fit in?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. We build websites for trades businesses, and the first draft of a new site is ready for your review within 10 business days of payment. If you'd like to talk it over, book a call.