Despite this coordination, WP-Engine (who's major business is hosting WordPress sites) is still on PHP 8.4.26 a full 2.5 hours after the patch is publicly available.

https://wpenginestatus.com/incidents/969801

It took 8 hours for CloudWays (DigitalOcean) to apply the patch. Big companies suck at responding to major stuff like this.

Could be backported?

I'm checking by ssh'ing into my environment, and this is what I see as of 21:41 UTC, several hours after the patches were published:

    wpe-user@MYENVIRONMENT.ssh.wpengine.net:~$ php -v
    PHP 8.4.26 (cli) (built: Sep 23 2026 06:24:29) (NTS)
    Copyright (c) The PHP Group
    Built by Perforce Zend (www.zend.com)
    Zend Engine v4.4.26, Copyright (c) Zend Technologies
        with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
I keep hoping for either a change in the version or the build date, but nothing yet. The incident status page says they're deploying, but there haven't been further updates about how far along they are.