--- title: "WordPress PHP Update Service: From $199 per Site | Web Aloha" description: "PHP security fixes for CVE-2026-109618 and CVE-2026-109619: we coordinate the update with your host, check backups and test your WordPress site. From $199 per site." canonical_url: "https://webaloha.co/wordpress-php-update-service/" markdown_url: "https://webaloha.co/wordpress-php-update-service.md" date_modified: "2026-10-28T00:00:00.000Z" --- PHP security update, 21 October 2026 # WordPress PHP update service We coordinate the PHP security update with your host, check your backups and test your website afterward. [Get help with my PHP update](https://webaloha.co/contact/?service=Website%20Maintenance&request=php-update&package=wordpress-php-update) [Ask your host first](#ask-your-host) From $199 per WordPress site We reply within 24 hours. Scope, price and timeline confirmed first Price and scope ## From $199 per WordPress site on managed or shared hosting ### Included - Confirm the active PHP version and patch status with your host. - Check that a current backup and a rollback route exist. - Coordinate the patch, or a move to a supported PHP branch, with your host. - Test key pages, login, forms and checkout afterward. - A short written summary of what changed. ### Quoted separately - Compatibility repairs, under the Website Fix Sprint ($555). - Upgrades from PHP 8.1 or older that need code changes. - Server administration on a VPS or dedicated server. - Migrations to another host or platform. - Suspected compromise or malware cleanup. Compatibility repairs follow the [Website Fix Sprint](https://webaloha.co/website-fix-sprint/): one website, one agreed priority, $555. One-time From $199 WordPress PHP Update for one WordPress site on managed or shared hosting. [Get help with my PHP update](https://webaloha.co/contact/?service=Website%20Maintenance&request=php-update&package=wordpress-php-update) We confirm the scope, price and timeline before starting. Timing ## How quickly we help We reply within 24 hours. For straightforward updates, we aim to complete the work within a few days once the scope and access are agreed. Ask your host to patch now. Our timeline should not delay that request. Ask your host first ## A message to send your hosting provider Your host controls the PHP runtime on managed and shared hosting. Copy this message into a support request, replace “my website” with your address, and ask for a written answer. Hello, Please confirm whether the PHP runtime serving my website includes the fixes for CVE-2026-109618 and CVE-2026-109619, which PHP released on 21 October 2026. 1. Which exact PHP version or vendor package revision is active for this site? 2. If you rely on backported fixes, please share the vendor advisory. 3. Does the update cover every web worker and server for this site, and has the required restart been completed? 4. If patching is still pending, what is the plan, and which exposure controls are in place until then? Please also review these separate PHP notices. Public PHP version clues cannot determine whether either applies: 5. For PHP's 23 October 2026 session upload progress notice (CVE-2026-115560), is session.serialize\_handler configured as php\_binary or php\_serialize and switched to php with ini\_set() before session\_start(), while upload progress remains enabled? Please confirm whether session.upload\_progress.enabled=0 is needed until the next regular bugfix release, and keep it in place if already applied. PHP had not named a fixed release when checked on 28 October 2026. 6. If this site runs PHP on Windows, please confirm the installed package includes Brotli 1.2.1 for CVE-2026-111497 (the 26 October 2026 -1 package rebuild or a vendor-confirmed dependency update), and whether cURL automatic HTTP response decompression is enabled. This package rebuild does not change the PHP runtime version. Thank you. What happened ## The 21 October 2026 PHP security release On 21 October 2026, PHP released critical fixes for [CVE-2026-109618 (opens in a new tab)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [CVE-2026-109619 (opens in a new tab)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). These are the first fixed upstream releases; later releases include the fixes too. First fixed upstream PHP releases for CVE-2026-109618 and CVE-2026-109619 | PHP branch | First fixed release | | --- | --- | | PHP 8.5 | 8.5.12 | | PHP 8.4 | 8.4.27 | | PHP 8.3 | 8.3.36 | | PHP 8.2 | 8.2.35 | | PHP 8.1 or older | No new release | PHP 8.1 and older no longer receive updates from the PHP project. For people who build PHP from source, the PHP security team published minimal source patches for [PHP 7.4 source patch (opens in a new tab)](https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619), [PHP 8.0 source patch (opens in a new tab)](https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619) and [PHP 8.1 source patch (opens in a new tab)](https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619). Some distributions and long-term support vendors provide backported fixes. Ask your vendor, and plan a move to a supported branch. A distribution or host may also backport the fixes into a package with an older-looking version number, so ask your host to confirm that the installed package fixes both vulnerabilities. ### Later notices need separate checks The first fixed releases above address the two 21 October vulnerabilities. They do not settle the later configuration or Windows dependency notices. Both need evidence from your host or developer. Configuration notice, 23 October 2026 · Applicability unknown #### Session upload progress configuration notice The unusual setup requires session.serialize\_handler to be configured as php\_binary or php\_serialize, switched to php with ini\_set() before session\_start(), and session upload progress to remain enabled. PHP recommends session.upload\_progress.enabled=0 until the next regular bugfix release. Keep that setting if already applied. Applications that never change the serialize handler at runtime can keep upload progress enabled. PHP plans the full CVE-2026-115560 advisory with the next release; no fixed release was named when checked on 28 October 2026. Public PHP version clues cannot establish whether this notice applies to the site. [Read PHP's official notice (opens in a new tab)](https://www.php.net/archive/2026.php) Windows package rebuild, 26 October 2026 · Applicability unknown #### Windows package rebuilds for Brotli The rebuilt Windows packages are 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. In PHP Windows builds, the Brotli decoder can be reached through cURL when automatic HTTP response decompression is enabled. cURL disables it by default, but applications and HTTP client libraries can enable it. The -1 suffix identifies Windows packages rebuilt with Brotli 1.2.1 for CVE-2026-111497. The PHP source releases and runtime versions stay unchanged. Ask the host to confirm the installed Windows package or vendor dependency update. Public PHP version clues cannot establish whether this notice applies to the site. [Read PHP's official notice (opens in a new tab)](https://www.php.net/archive/2026.php) - [Read our guide to the October 2026 PHP security update](https://webaloha.co/php-security-update-october-2026/) - [Check which PHP version a website shows publicly](https://webaloha.co/tools/php-version-checker/) - [Read PHP's official announcement on php.net (opens in a new tab)](https://www.php.net/archive/2026.php#2026-10-21-5) Our PHP Version Checker reads public version clues. It cannot confirm the installed fixes or whether the later notices apply. Ask your host or server administrator for runtime, configuration and package evidence. Why ask us ## WordPress and PHP guidance others link to [Elementor's official system requirements (opens in a new tab)](https://elementor.com/help/requirements/) link to [our Elementor PHP guide](https://webaloha.co/elementor-and-php-compatibility/) in their PHP recommendation. ### Our WordPress and PHP guides - [Critical PHP Security Update: October 2026 Patches Explained](https://webaloha.co/php-security-update-october-2026/) - [Fix WordPress Technical Difficulties and Critical Errors](https://webaloha.co/wordpress-critical-error-recovery/) - [Increase WordPress Memory Limit: Find the Limit That Applies](https://webaloha.co/wordpress-memory-limit/) - [Edit WordPress robots.txt and Verify the File Crawlers Receive](https://webaloha.co/wordpress-robots-txt/) - [PHP Version Statistics After PHP2Shell: 100,000+ Sites](https://webaloha.co/php-version-statistics-2026/) - [Elementor PHP Requirements: Versions, Memory and Compatibility](https://webaloha.co/elementor-and-php-compatibility/) - [PHP 8.2 End of Life (Dec 31, 2026): WordPress Upgrade Plan](https://webaloha.co/php-8-2-end-of-life-wordpress/) - [Recommended PHP Version for WordPress (2026): 8.3, 8.4 or 8.5?](https://webaloha.co/recommended-php-version-for-wordpress/) - [WordPress and PHP 8.4 Compatibility: Supported Versions and Testing](https://webaloha.co/wordpress-compatibility-with-php-8-4/) - [WordPress and PHP 8.5 Compatibility: Official Support and Safe Testing](https://webaloha.co/wordpress-php-8-5-compatibility/) - [PHP Extensions for WordPress: Required vs Recommended](https://webaloha.co/php-extensions-for-wordpress/) - [WordPress 7.0 PHP Requirements and Compatibility](https://webaloha.co/wordpress-7-php-version-compatibility/) ★★★★★ > “Absolutely amazed at the service provided, not only have they designed my original business website 7yrs ago and have provided me with maintenance over the years but recently got an upgraded website over haul and new design. Couldn’t speak any more highly.” Wellington House Repiling Ltd, construction, New Zealand · [Trustpilot review (opens in a new tab)](https://www.trustpilot.com/reviews/69cb7f2168abfa665b599f5b) After the update ## Ongoing care for future security updates Our WordPress care plans start at $49/month and keep core, theme and plugin updates, backups and monitoring on a routine, so the next security update has an owner. [See WordPress care plans](https://webaloha.co/wordpress-website-maintenance-services/) WordPress PHP update ## Questions about the PHP update Does a first fixed PHP release resolve the later October notices? No. The first fixed releases listed here address CVE-2026-109618 and CVE-2026-109619. PHP's 23 October session upload progress notice needs a configuration and application-code check, and its 26 October Windows rebuild updates Brotli without changing the PHP runtime version. Public PHP version clues cannot establish whether either later notice applies. Ask your host and developer to review them. Will updating WordPress or Elementor fix the PHP vulnerabilities? No. WordPress and Elementor updates do not replace the PHP runtime on your server. Your hosting provider or server administrator must install the PHP security update for CVE-2026-109618 and CVE-2026-109619 and activate it for your site. Keep WordPress and plugin updates current as well. What does the $199 PHP update include? For one WordPress site on managed or shared hosting, we confirm the active PHP version and patch status with your host, check that a current backup and a rollback route exist, coordinate the patch or a move to a supported PHP branch with your host, test key pages, login, forms and checkout afterward, and send a short written summary of what changed. What is quoted separately? Compatibility repairs go under the Website Fix Sprint ($555). Upgrades from PHP 8.1 or older that need code changes, server administration on a VPS or dedicated server, migrations, and suspected compromise or malware cleanup are quoted separately. We confirm the scope, price and timeline before starting. How fast can you help? We reply within 24 hours. For straightforward updates, we aim to complete the work within a few days once the scope and access are agreed. Ask your host to patch now. Our timeline should not delay that request. What if my host cannot patch yet? Ask the host for a concrete patching timetable and for the exposure controls they will use until the fix is installed. A firewall rule, a hidden version header or a WordPress plugin does not confirm that the PHP runtime has been fixed. What if the PHP update breaks something? Involve the host straight away. Rolling back to a vulnerable PHP build reopens the risk, so agree on a patched alternative while the problem is fixed. Compatibility repairs are scoped as a Website Fix Sprint ($555) for one website and one agreed priority. Do you work with agencies? Yes, through our referral programme. Refer your client and earn 10% of the project fee. We work with your client directly, and we never do white-label work. Agencies and developers: [refer your client](https://webaloha.co/refer-a-client/) and earn 10% of the project fee. Referral terms apply. A clear next step ## Get your PHP update coordinated and tested Send your website and, if you know it, your hosting provider. We confirm the scope, price and timeline before starting. [Get help with my PHP update](https://webaloha.co/contact/?service=Website%20Maintenance&request=php-update&package=wordpress-php-update) [Ask your host first](#ask-your-host) We reply within 24 hours.