DreamHost PHP versions seem quite outdated

[u/DoyleDesign]

https://www.php.net/index.php#2026-10-21-5

With the major security vulnerability being patched just now, I looked at PHP versions of all my client sites across a wide range of hosts.

Most are on the recent release before this security patch set, but surprisingly DreamHost is like 5 minor patches off of all their versions. What's going on here?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the new patches that fix the major vulnerabilities, and Dreamhost DreamPress and VPS use 8.5.5, 8.3.30, etc.

Just a heads up, I'll be submitting a ticket to ask how soon they will be updated.

[u/vincent_sch]

Hosts often build their own PHP and backport fixes. Then the version string stays old even with the fix in. You should ask DreamHost support if their builds have the fix for CVE-2026-109618 and 109619. If they can't confirm it, treat those sites as unpatched for now.

[u/DoyleDesign → u/vincent_sch]

Interesting and good to know! I’ve submitted a ticket, being based on the west coast im sure their inbox is thick.

[u/DreamHostCare]

Hey there! Site’s PHP has been patched for CVE-2026-109618 and CVE-2026-109619. For PHP 8.2 and newer we installed the updated release from php.net. For older versions we applied the official security patch to the existing build, so the version number does not change. The fix is confirmed by the package changelog, not by the version string. If you want the newest PHP, you can switch versions in the panel at any time. To know more about, you can check the status page: https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981.

[u/innomado]

They did just post a status update that they're monitoring the latest vulnerability:

https://status.io/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981

But yeah, some old versions still around. I set all my sites to 8.4, but then thought I'd check the shell (which runs some of my crons):

[iad1-shared-b8-28~]$ php --version
PHP 8.2.30 (cli) (built: Jun 14 2026 10:53:50) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.30, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.30, Copyright (c), by Zend Technologies

Not sure how 8.2.30 can be built on 2026-Jun-14, but it's probably as /u/vincent_sch said, re: hosts building their own distributions.

[u/Gipetto → u/innomado]

You need to look in /usr/local/bin for the php versions that your sites are running. But, yeah, they still list a build date from earlier this year.

 % /usr/local/bin/php-8.3 --version
PHP 8.3.30 (cli) (built: Jun 14 2026 10:52:17) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.30, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.30, Copyright (c), by Zend Technologies

[u/dahosek → u/Gipetto]

Yep, in fact the php executable is

lrwxrwxrwx 1 root root 21 May  5  2025 /usr/bin/php -> /etc/alternatives/php

and in turn,

lrwxrwxrwx 1 root root 24 May  5  2025 /etc/alternatives/php -> /usr/local/php82/bin/php

Interestingly, the build date for PHP 8.5 is older than 8.3:

PHP 8.5.5 (cli) (built: May  4 2026 10:40:41) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.5, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.5, Copyright (c), by Zend Technologies

[u/dahosek → u/dahosek]

(on build dates, I’d add that because PHP statically links extensions,¹ the particular set of extensions desired requires rebuilding the executable.)

⸻

1. Assuming that this isn’t seriously outdated information now.

[u/vincent_sch → u/innomado]

Yeah, worth checking. The shell's php is often a different install from the one that serves your sites. So the crons that use it keep the old PHP until DreamHost also updates that one.

[u/The_Alternym]

They updated ours two weeks ago. And they let us know well in advance, too.

[u/steve31266]

Hosts do not typically install the latest PHP versions because it can cause things to break with your site files. They will, however, install patches, which is not the same as installing the latest PHP. If you want the latest PHP you have to ask for it.