How to Update PHP in WordPress and cPanel (October 2026 Security Update)

After the critical PHP security update of 21 October 2026 (CVE-2026-109618 and CVE-2026-109619), millions of WordPress site owners need to update PHP. The good news: on most hosting you can do it yourself in a few minutes, without touching code. This guide shows how to check your PHP version, update it in cPanel, Plesk or your host's dashboard, and what to do if something breaks.

Why you need to update PHP now

PHP is the language WordPress runs on. It is installed on your server, separately from WordPress, so updating WordPress, your theme or your plugins does not update PHP. The October 2026 vulnerabilities are in PHP itself and can let an attacker run code on the server without logging in. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get security fixes at all, and PHP 8.2 reaches end of life on 31 December 2026.

Step 1: check your PHP version in WordPress

1. Log in to WordPress as an administrator.
2. Go to Tools → Site Health → Info.
3. Open the Server section and look at PHP version.

The Status tab of Site Health also warns you when your PHP version is outdated. Prefer not to log in? Our free PHP version checker shows the version your site announces publicly, if your server shows it.

Step 2: prepare before you change anything

• Make a full backup of files and database. Most hosts offer one-click backups or a backup plugin can do it.
• Update WordPress, your theme and all plugins first. Newer versions support newer PHP. Old, abandoned plugins are the most common cause of problems after a PHP change.
• Use a staging copy if you have one. Many hosts can clone your site to a staging site; change PHP there first.
• Check the current PHP recommendation on WordPress.org and note which plugins your site cannot live without.

Step 3a: update the PHP version in cPanel

Most shared hosting uses cPanel. Depending on your host you will see one of two tools:

• MultiPHP Manager: open it from the cPanel home page (search "PHP"), tick your domain, choose the new version (for example PHP 8.3 or 8.4) in the drop-down and click Apply.
• Select PHP Version (on CloudLinux hosting): open it, pick the new version next to Current PHP version and click Set as current. Keep the PHP extensions your site needs switched on.

Important: cPanel lets you choose the PHP branch (8.3, 8.4); the exact release inside it (for example 8.3.36) is installed by your host. After switching, check Site Health again. If it still shows an older 8.3 or 8.4 release, ask your host when they will install the October 2026 security update.

Step 3b: Plesk

Go to Websites & Domains, open PHP or PHP Settings for your domain, choose the new PHP version and save.

Step 3c: update PHP in WordPress without cPanel

Many hosts, including GoDaddy, Bluehost and most managed WordPress hosts, have their own dashboard instead of cPanel. Look for a setting called PHP version, PHP settings or PHP engine in the site or hosting settings. On managed WordPress hosting the provider often updates PHP for you; if you cannot find the setting, contact support and ask them to move your site to a supported, patched PHP version.

On your own VPS or server, PHP is updated with the server's package manager, not from WordPress. Our PHP security guide covers Ubuntu, Debian, Red Hat, Docker and Windows.

Step 4: test your site

Right after the change, open your site in a private browser window and check:

• the home page and a few important pages,
• logging in to WordPress and the admin area,
• contact forms (send a test message),
• the shop, cart and checkout if you use WooCommerce,
• any membership, booking or payment features.

If something breaks

• White screen or "There has been a critical error on this website": switch back to the previous PHP version in the same menu. WordPress usually also emails the site administrator a recovery link that lets you log in and see which plugin or theme failed.
• One plugin fails: update it, or replace it if it is no longer maintained. Then switch PHP again.
• Warnings on the page: these are usually "deprecated" notices from old code. Turn off error display on the live site and fix the code or plugin.

Switching back to an old PHP version is only a short-term fix: it leaves the site open to the vulnerabilities. Plan to fix the plugin or theme within days, not months.

Which PHP version should you choose?

Choose	When
PHP 8.3 or 8.4	Best for most WordPress sites today, as long as your plugins and theme are up to date.
PHP 8.2	Only as a short step if a plugin does not yet work on 8.3. It reaches end of life on 31 December 2026.
PHP 8.1, 8.0, 7.4	Do not stay here: no security fixes. Upgrade as soon as possible.

Need help?

If your site uses old plugins, a custom theme or WooCommerce with many add-ons, a PHP change can be risky. Our PHP security update service does it for you: backup, update on a staging copy, fix what breaks, switch the live site and test it, with a short report. Not sure where to start? Send us your site address and an engineer will tell you what to do.