Sites on PHP 8.2 and newer now show the PHP project's new version numbers in WordPress Site Health: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. CloudLinux released builds carrying these numbers, and our regular updates installed them. A small number of sites may take up to another day to show the new number.
This changed only the number shown. The security fixes (CVE-2026-109618 and CVE-2026-109619) were installed and verified on every WPCloud server on 21 October, and your site has been patched since then.
Sites on PHP 8.1 and older (for example 8.1.34 or 7.4.33) keep their version number permanently, because the PHP project no longer releases new versions of them. CloudLinux adds the fix to the existing version, so those sites are patched too.
You don't need to do anything, and you don't need to open a ticket to check your PHP version. If your IT department, insurer or auditor needs written confirmation, open a ticket and let us know who it is for.
IMPORTANT: THE PHP VERSION NUMBER SHOWN FOR YOUR SITE DOES NOT TELL YOU WHETHER IT IS PATCHED. YOU MAY NOT SEE 8.5.12, 8.4.27, 8.3.36 OR 8.2.35, AND THAT IS EXPECTED.
The critical PHP security fixes released on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) were installed and verified on every WPCloud server on 21 October. You don’t need to do anything.
Why your version number looks unchanged: our PHP comes from CloudLinux, which adds security fixes to the version already installed instead of moving to a new version number. For example, a site on PHP 8.3 keeps showing 8.3.35 after the fix, even though PHP’s own fixed release is numbered 8.3.36, and a site on PHP 7.4 keeps showing 7.4.33. CloudLinux explains this in its advisory: https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916 and is planning a change to how patched versions are numbered to prevent this confusion in future.
Please don’t open a ticket to check your PHP version. Updating WordPress, plugins or themes won’t change anything either, since PHP is installed on our servers, not inside your website. If your IT department, insurer or auditor needs written confirmation, open a ticket and let us know who it is for.