On October 21, 2026, Convesio protected every WordPress site on its platform against two critical PHP vulnerabilities that could allow unauthenticated remote code execution. Customers on maintained PHP versions did not need to take any action.
For commerce businesses, the hours after a vulnerability goes public matter most. Attackers move quickly once a flaw is announced, and a store that stays exposed for days carries real risk to its revenue and its customers’ data. Our team took action immediately to protect you.
What happened
On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities had allowed an attacker to run code on a server without logging in.
PHP is the language WordPress and WooCommerce run on, so an unpatched PHP version leaves every site on it exposed.
What Convesio did
Convesio’s infrastructure team mitigated risk ahead of the PHP patch release.
- Within hours of the release, the team applied a mitigation in the PHP configuration on every server in our hosting platform.
- By the evening of October 21, the team had built patched container images, the underlying builds your site runs on. Moving every running site onto them is under way, and the mitigation protects each site until its move completes.
- The team also inventoried Convesio’s own PHP applications and mitigated each one. ConvesioConvert now runs PHP 8.5.12, the patched release.
A small number of sites restarted briefly while the fix rolled out. Our Support team handled those restarts directly.
What customers need to do
If your site runs PHP 8.2 or newer, you don’t need to do anything. It’s protected now and moves to a patched build automatically.
Two situations need a quick conversation with our Support team:
- Older builds. Some long-running sites sit on an older build that limits which PHP versions appear in the dashboard. Support can move your site to a current build during off-hours, with roughly two minutes of downtime.
- PHP 8.1 or earlier. See below.
For small sites, the best option is to move your site to Express. Express runs on the current, fully supported PHP stack and gets security updates as they’re released, so your site stays protected without you having to track PHP versions yourself. It’s the modern technical foundation we’re building WordPress hosting on. Our Support team can help you plan the move.
Why we’re drawing a line on end-of-life PHP
For years, we’ve kept sites running on PHP versions long after the PHP project stopped supporting them. We did that on purpose. Plenty of serious businesses depend on plugins and custom code that weren’t ready to move, and we’d rather carry a site forward than break it.
This week showed us that this approach has run its course. PHP 8.1 and earlier get no security fixes from the PHP project. When vulnerabilities land, there’s no patch for those versions, only workarounds, and each one gives less protection than the last. We can’t fully protect a site on a version nobody patches.
So starting October 22, 2026, Convesio will no longer support PHP 8.1 or earlier. Sites on those versions need to move to PHP 8.3 or 8.4 as soon as possible. PHP 8.2 reaches end-of-life on December 31, 2026, so if you’re upgrading now, go straight to 8.3 or 8.4. If a plugin misbehaves after the switch, you can move to another supported version from the Convesio dashboard.
We know that’s a firm line. You won’t have to handle it alone.
- Included support. Our Support team, included with every plan, will check your site, switch your PHP version, and help you test.
- Hands-on code fixes. If the upgrade breaks a plugin, theme, or custom code, our Professional Services team can fix it. This is paid work by our WordPress engineers. Email proservices@convesio.com to get started.
Need help?
Chat with our Support team from the Convesio website to check your site’s PHP version or schedule a build update. For plugin, theme, or code fixes, email our Professional Services team to work with us on a one-time project: proservices@convesio.com.
