Blog Details

CVE-2026-109618 and CVE-2026-109619 – If you’re hosted with us, you’re covered.

On 21 October 2026, the PHP project released fixes for two serious security flaws in PHP, the language WordPress runs on (CVE-2026-109618 and CVE-2026-109619).

If you’re hosted with OmniOnline, the Patching is complete. The official fixes are now installed on our servers for current and older PHP versions alike.

There is nothing you need to do. You don’t need to open a ticket, change your PHP version, update WordPress or take a backup.

About your PHP version number: sites on PHP 8.2 and newer now show the PHP project’s new version numbers (8.2.35, 8.3.36, 8.4.27 or 8.5.12). Sites on PHP 8.1 and older, such as 7.4.33, keep their version number permanently, because the PHP project no longer releases new versions of them. Either way, your site has been patched since 21 October; the number shown doesn’t tell you whether a site is patched.

Every server was protected from early on 21 October, before the official fix was released. Our monitoring found no sign that any attack attempt succeeded on our servers. If we ever find anything that affects your site, we will contact you directly.

If your IT department, insurer or auditor needs written confirmation, please email contact@omnionline.net and let the team know.

Thanks for being an OmniOnline customer and trusting us with hosting your WordPress website.