Protect your remaining WordPress sites by October 31

Nearly every WordPress site hosted on Vendasta has already moved to our new hosting. A few sites remain on older infrastructure and require a decision from you before the final deadline on October 31.
Sites on our new hosting are already protected
On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthenticated remote code execution, and active exploitation has been observed.
Sites hosted on our new infrastructure were protected against both vulnerabilities prior to public disclosure. You and your clients do not need to take any action for these sites.
Sites on older infrastructure require action
The remaining sites run on an older PHP version, which prevented them from migrating automatically and leaves them without this protection. Upgrading them to PHP 8.3 is the fastest way to secure them and complete their migration.
Choose an option for each site
Upgrade it yourself:
 Use the tracker to identify what is preventing each site from running on PHP 8.3.
Have Vendasta Services rebuild it
: Request a paid rebuild, which begins once you provide written approval (recommended if you do not have a developer available).
Retire it
: Decommission sites your clients no longer need.
How to review your sites
Enter your Partner ID
 into the tracker tool to view all sites requiring a decision and their current blockers.
If no sites appear, all of your sites are already migrated and protected.
What happens after October 31
After the deadline, we will automatically attempt to upgrade every remaining site to PHP 8.3 and migrate it to the new hosting environment. Any site incompatible with PHP 8.3 will go offline and remain offline until it is updated or rebuilt.
Need a hand?
Submit a support ticket directly in Partner Center.