What to send your WordPress hosting company about the October 21 fix
Copy-and-paste messages for your hosting company, web agency, or site builder, how to read the reply, and a follow-up if nobody answers in 24 hours.
Ask your hosting company, the company you pay to keep your website online (GoDaddy, Bluehost, SiteGround, and so on), one question in writing: does your website's PHP have the October 21, 2026 fix? PHP is the software WordPress runs on behind the scenes. Below are messages to copy for a hosting company, a web agency, and the person who built your site, plus a follow-up for when nobody answers.
Why ask instead of checking yourself?
You can see your PHP version in WordPress under Tools, Site Health, Info, Server, and our step-by-step guide explains it. But some hosting companies install the fix without changing that number (Wordfence), and WordPress.org tells owners to check with their hosting company (WordPress.org).
The codes CVE-2026-109618 and CVE-2026-109619 in each message are the official IDs for the two bugs. They tell support staff exactly which fix you mean.
Which message should you send?
If you pay a hosting company directly, send it the first message. If a web or marketing company built your site or bills you monthly for it, use the agency message. If a friend, relative, or independent developer built it, use the builder message. Not sure? Search your card statements and email for "hosting" or "renewal," because whoever bills you for hosting is usually the hosting company.
What do you send a hosting company?
Send it as a support ticket if you can, so you have a record. Use the subject line "PHP security fix for CVE-2026-109618 and CVE-2026-109619" and this message:
Hello, my site [yourdomain.com] runs on your hosting. Please tell me, in writing:
1. Which PHP version my site uses now, and whether it includes the fix for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport).
2. If it is not fixed yet, when it will be.
3. Whether I need to change anything myself, such as moving to a newer PHP version.
Thank you.
[Your name], [account email or account number]The versions in point 1 are the official fixed releases (php.net). A "vendor backport" is the fix copied onto an older version by your hosting company's software supplier.
What do you send a web agency?
Use the subject line "Is [yourdomain.com] running the October 21 PHP fix?" and this message:
Hi [Name],
PHP released fixes on October 21 for two critical bugs (CVE-2026-109618 and CVE-2026-109619). WordPress.org says no WordPress update is needed, so the fix has to happen on the server. Please answer in writing by [day and time]:
1. Who hosts [yourdomain.com], and who is responsible for keeping PHP patched there?
2. Which PHP version is the site on now, and does it include the fix (8.5.12, 8.4.27, 8.3.36, 8.2.35, or a backport from the host)?
3. If it is on PHP 8.1 or older, when can you move it to 8.3 or newer, after a backup and a test?
4. Have you checked for signs the site was touched before the fix, such as new admin users, unfamiliar files, or redirects?
Thank you.
[Your name], [phone]What do you send the person who built your site?
Use the subject line "Quick PHP question about [yourdomain.com]" and this message:
Hi [Name],
A quick one about [yourdomain.com]. PHP shipped fixes on October 21 for two critical bugs (CVE-2026-109618 and CVE-2026-109619). WordPress.org says the fix is a PHP update on the server, not a WordPress update. Can you tell me:
1. Where the site is hosted, and who has the hosting login?
2. Which PHP version it runs? (In WordPress: Tools, Site Health, Info, Server.)
3. Whether the host has installed the fix, and can you get that confirmed in writing?
4. If it is on PHP 8.1 or older, can we move it to 8.3 or newer after a backup?
Please reply by [day]. I would rather not try a plugin or a pasted snippet for this.
Thank you,
[Your name]How do you read the reply?
| If the reply says | It means | Your next step |
|---|---|---|
| 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or higher in the same series | The official fix is installed. | Save the reply. |
| The fix is backported, with an older version number | The fix was copied onto your version. | Save the reply. It's the proof the number can't give you. |
| "Mitigations in place" or "protected by our firewall" | Protection while the fix rolls out, not the fix itself. | Reply and ask for the date of the real fix. |
| PHP 8.1 or older, with no backport mentioned | The PHP project no longer fixes these versions. | Ask about a backport, and for a date to move to PHP 8.3 or newer after a backup. |
| "No action needed," with no version | Point 1 isn't answered yet. | Ask again for the version and whether it includes the fix. |
Name your plan in the message, because one company can give two answers. As of October 21, 2026, GoDaddy said "We have patched all PHP versions" on Managed Hosting for WordPress, while its Web Hosting and Windows Hosting plans had mitigations in place as it waited for patched packages from its vendor (GoDaddy). Notices like this change through the day, so re-check with your hosting company.
What if nobody answers in 24 hours?
Send this follow-up, with the subject line "Following up: PHP fix for [yourdomain.com]":
Hi [Name],
Following up on my message from [yesterday or date]. I still need a written answer on whether [yourdomain.com] has the fix for CVE-2026-109618 and CVE-2026-109619. If you are not the right person, please point me to who is. If you need more time, please give me a date.
If I do not hear back by [time], I will [call you / ask for a manager / open a second ticket].
Thank you.
[Your name], [phone]If that goes unanswered too, call and ask for a manager. These messages, with live updates, are also on our WordPress advisory page.
Who is The Graphite Lab?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to, and there's no PHP fix to chase. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. If you'd like to talk about a new site, the first draft is ready for your review within 10 business days of payment.
Want to see this on your board?
Book a 30-minute call and we’ll walk through it live.