Check hosting PHP: Xserver, Sakura, ConoHa WING and Lolipop

Information reviewed：2026-10-21 · Published by Tsumira Japan (SourceArt Ltd)

Settings can differ by hosting plan and domain. Use the provider’s official control panel, then confirm security patch status separately with its notices or support.

Use the official setting for your plan

Xserver documents PHP version switching in its server panel; Sakura uses its server control panel. ConoHa WING and Lolipop provide site or domain PHP settings. Follow the current official guides linked below.

The existence of a version selector does not establish that a particular plan has been patched. This article does not certify any provider or plan as fixed.

Ask a question support can resolve

Include the affected domain, plan, displayed PHP and the CVEs you need checked. Share account identifiers only through the provider’s official support channel as needed.

Ask separately whether the supplier has applied a fix and whether you must perform an update, switch or other action. A vendor backport can make the displayed version alone inconclusive.

Turn the answer into an action plan

Confirm the answer covers your actual server and plan. Runtime maintenance and application compatibility may have different owners.

If a change is required, record the old setting, backup and recovery steps before following the provider’s instructions.

A supplier enquiry you can adapt

Replace the bracketed fields and use your provider’s official support channel.

Website: [URL]
Hosting plan: [plan]
Displayed PHP: [value]

Please confirm whether this environment has fixes for CVE-2026-109618 and CVE-2026-109619. If fixes were backported without changing the upstream number, how can we verify them? Please distinguish any action required from us from work performed by your team.

Questions and answers

Does an older number mean unpatched?

Not necessarily. Ask the supplier about the exact package and backport status.

What if we do not know our provider?

Check contracts, billing and the maintenance contact. Public DNS alone may not identify the contractual provider.

Official references

Official guidance and interfaces can change. Confirm your actual plan, configuration and the supplier’s latest notice. This guide does not certify the security or patch status of any individual environment.

Need help with your site?

We can help clarify the information and scope. Paid work begins after you approve the scope and cost.

Ask about this topic →Free website check →

Meet Tsumira developer Steve vom Wege · Tsumira.jp ↗