ChatGPT, Claude, Gemini, Grok — all four for $20.00/mo

0
View Pricing

PHP Security Update: How to Check My Version of PHP ?

Home 
 
/
 PHP Security Update: How to Check My Version of PHP ?

We've added extra security protections to our servers because of a serious issue found in PHP, the software that runs WordPress and most websites. Your website and email should keep working normally. For a short time, you might notice limits when uploading larger files.

Important: The most important thing you can do is make sure your site uses PHP 8.2 or later, and update WordPress and your plugins. The steps are below.

What happened

On October 21, 2026, the team that maintains PHP announced two critical security issues (CVE-2026-109618 and CVE-2026-109619). If left unprotected, these issues could let an attacker take control of a website.

This affects PHP websites everywhere, not just Bluehost. Security researchers found more than 22 million websites around the world that could be at risk, and attack tools are already public. That's why we acted right away.

How we're protecting you

We've already taken these steps on our servers:

  • We added temporary safety limits. On October 21, 2026, we put limits in place that block the known ways attackers use these issues.
  • We're installing the fixes. As PHP releases patches, we apply them right away wherever we can.
  • We're watching for suspicious activity. If we see harmful activity on a server, we may take network action to stop it from spreading.

We'll remove the temporary limits once all patches are installed. You can follow our progress on the Bluehost status page.

What you might notice

For most people, nothing changes. You might only notice something when you send a lot of data to your site at once.

What you might notice
If you're trying to... You might see...
Upload a large image, video, PDF, theme, or plugin The upload stops, or you see a message that the file is too large.
Save a long form or settings page, such as a big menu or product listing Your changes don't save, or the page reloads without them.
Restore a backup The restore stops partway or says the file is too large.

Note: These messages don't mean anything is wrong with your site. Your files, content, and backups are safe, and nothing has been changed or deleted.

What you should do now

Our server protections help a lot, but keeping your own site up to date is the best way to stay safe. Please take these steps as soon as you can:

  1. Check your PHP version and update it to 8.2 or later. Not sure which version you have? See How to View and Understand PHP Info in Bluehost Portal. If you have VPS or Dedicated hosting, see How to Change PHP Versions on VPS and Dedicated Servers.
  2. Update WordPress, your theme, and your plugins. Install the latest versions of everything on your site.
  3. Add extra protection if you can. If part of your site doesn't need to be public, limit who can reach it. You can also use firewall rules (WAF) to block harmful traffic. The PHP team shares more ways to limit your exposure.

If an upload, form, or restore isn't working

Here are a few easy ways to get things done while the temporary limits are in place:

  • Upload big files another way. Use File Manager in your Bluehost account, or an SFTP app, to upload large files directly.
  • Make files smaller. Compress images and videos or upload a few files at a time.
  • Save in smaller pieces. On long menus or product pages, save your changes more often.
  • Try again later. If it can wait, the limits will be lifted once all patches are installed.

Need a backup restored now? Contact Bluehost Support and mention this article. We're happy to help.

Contact Bluehost Support

Warning: Please don't change PHP settings yourself (for example in php.ini, .user.ini, or .htaccess) to get around the limits. These limits help keep your site safe.

Common questions

Q: Will older versions of PHP recieve a patch update?

A: No. PHP 8.1 and earlier versions will not receive patches. The vulnerable versions range from PHP 5.4 to 8.5.11; fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP project will not release fixes for version 8.1 or earlier, which have reached end-of-life.

 

Q: Was my website hacked?

A: These protections are a precaution to help safeguard Bluehost-hosted websites. Bluehost installs the updated PHP patch (on shared plans), while it’s up to the customer to ensure they are using PHP 8.2 or higher. 

Q: Will my website or email go down?

A: No. Your website and email should keep working normally.

Q: Do I really need to update PHP?

A: Yes, please do. Our fixes protect the server, but sites on older PHP versions are still at risk. Updating to PHP 8.2 or later, along with WordPress and your plugins, is the best protection.

Q: When will uploads go back to normal?

A: As soon as all patches are installed. We post regular updates on our status page.

Q: Could Bluehost take action on my server?

A: Only to keep things safe. If we detect harmful activity on your server, we may take network action to limit the impact.

Thanks for your patience while we keep your site safe. These guides can help you keep your website healthy and secure: