Vendasta has set October 31 as the deadline for WordPress sites on older infrastructure to move to PHP 8.3. Sites on Vendasta's new hosting were already protected against two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before their October 21 public disclosure. Active exploitation has been observed.
Sites still on older infrastructure need a decision. Partners can upgrade the site themselves, request a paid rebuild by Vendasta Services after written approval, or retire the site. The Partner ID entered into the tracker tool lists every site that needs a decision and its current blockers.
After October 31, Vendasta will automatically upgrade remaining sites to PHP 8.3 and migrate them to the new hosting. Any site that PHP 8.3 cannot run will go offline until it is updated or rebuilt.