How to Check and Update PHP for WordPress in cPanel

To check PHP for a WordPress site in cPanel, open Software → MultiPHP Manager and record the version assigned to each relevant domain. After PHP’s October 21, 2026 security releases, ask your hosting provider to confirm whether the server package includes the applicable fixes—especially if a patched option is unavailable or the version label does not tell you whether a vendor backport was applied. Then coordinate an update and test the site’s important functions.

This guidance is for WordPress site owners using cPanel. The available versions, account controls and update process depend on the host and server configuration. A cPanel version label alone does not establish whether a site is patched, and changing PHP branches can affect themes, plugins or custom integrations.

What changed in PHP’s October 21 security update?

The PHP project announced releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address CVE-2026-109618 and CVE-2026-109619. PHP described the vulnerabilities as critical and said they could allow unauthenticated remote code execution; it strongly encouraged users to update immediately. The PHP Security Release Announcements also say Linux distributions and long-term support (LTS) vendors received patches in advance. Those vendors may package a fix differently or backport it, so the upstream release number is not a universal way to identify a patched server.

PHP says version 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors may provide backported fixes for those versions; PHP advises users to check with the relevant vendor or upgrade to a supported version. Ask your host which situation applies to your account rather than assuming that an older version label proves either that the server is vulnerable or that it has been fixed.

Check the version assigned to each domain

Sign in to cPanel and open Software → MultiPHP Manager.
Find each domain that serves a WordPress site and record the PHP version shown beside it. cPanel’s interface lists non-parked domains and their assigned versions.
Note whether MultiPHP Manager is disabled, whether a version you expect is missing from the selection menu, or whether you cannot change the setting. Do not treat a missing option as permission to install PHP yourself.

The cPanel & WHM documentation for MultiPHP Manager explains that a version absent from the account’s menu may not be installed on the server or available to that account. The system administrator can install PHP versions in WHM, and account limits may prevent a customer from changing versions. If the interface or needed choice is unavailable, contact the host. Even when a version is displayed, ask the provider to confirm the installed package’s patch status, including any vendor backport.

Choose an update or a PHP branch migration

An update within the current branch and a migration to a different branch are separate decisions. If the host supports a fixed release for the branch your site uses, ask whether you can update within that branch. Moving to another branch is a broader compatibility change: confirm that the host supports the target version and check your WordPress setup—including its theme, plugins and custom integrations—before switching. The available sources do not establish compatibility for any particular site.

If you manage PHP through cPanel, make a change only when the option is available and supported by your host. Otherwise, ask the provider to apply the update or explain the supported path. A WordPress plugin or theme update does not patch a vulnerability in the PHP runtime.

Hypothetical store example

A store owner sees an older PHP branch in MultiPHP Manager and no patched choice. The owner should not assume the store is vulnerable based on that label—or assume Cloudflare resolves the issue. A useful support request is: “MultiPHP Manager shows PHP [version] for [domain], but I don’t see a patched option. Can you confirm whether the server package includes the fixes for CVE-2026-109618 and CVE-2026-109619, including any vendor backport? If it does not, please advise on and manage the provider-supported update, and let me know whether a branch migration is required.”

Verify the site after the change

After you or the host applies a change, check Tools → Site Health → Info in WordPress. Review the server details and PHP-related information reported there. The WordPress Site Health Screen documentation describes the Info screen as a place to review technical details about the server setup; some server changes require help from the hosting provider.

Then test representative public pages, sign in to wp-admin, and exercise the business-critical workflows your site relies on, such as a contact form or checkout. Watch for changed browser behavior or new browser-console errors, WordPress notices, and relevant server or PHP error-log entries. Ask the host where to find server logs if they are not available in your account. The expected result is that Site Health reports the intended server and PHP information, pages and administrative access load, key workflows complete, and testing reveals no new errors or notices. These checks are practical verification, not proof that every compatibility issue or defect is absent.

Keep Cloudflare WAF protection in its proper role

Cloudflare’s guidance on PHP vulnerability WAF protections describes its php2shell protections as available on plans where WAF is deployed. Its guidance recommends applying the PHP vendor update while keeping WAF protection enabled as an additional defense. If you have a paid plan, Cloudflare says to check that the Managed Ruleset is deployed in block mode. Confirm what is actually enabled for your configuration; do not assume the same rules are active on every plan. WAF protection does not replace updating or obtaining confirmation about the PHP package.

Make the next step clear

You can select a supported patched release: confirm compatibility and the host’s instructions, make the change, then run the verification checks above.
The interface or patched choice is unavailable—or package status is unclear: ask the host to confirm the fix, including any backport, and handle the update if needed.
You are considering a different PHP branch: verify host support and site compatibility before migrating.

Coordinating a provider-managed change, checking WordPress workflows and documenting the result are practical parts of ongoing site care. Splinternet Marketing’s website maintenance service can help with that work and continued measurement and improvement. Brian Bateman’s managed service draws on 30 years of experience and DOYJO’s process, with technology supporting ongoing data-driven work; it is $421 per month per business, month to month, and can be canceled at any time.

Sources

Editorial note: AI assists with research, drafting and automated checks. Sources are linked so you can verify the guidance. Platform requirements can change; confirm the details that apply to your setup.