Critical PHP Security Vulnerability: What Website Owners Need to Do Now

22 October 2026 By Benjamin Hall 9 min read

If your website runs PHP, there is an important security update you should not ignore. On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable servers without needing to log in.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have both received a CVSS v4.0 severity score of 9.2 out of 10. The UK National Cyber Security Centre has advised organisations to take immediate action.

This affects far more than WordPress websites. PHP powers everything from small business websites and online shops to Laravel applications, customer portals, internal management systems and other business-critical software. If your hosting environment runs a vulnerable version of PHP, your website could be at risk regardless of which framework or content management system you use.

What Is the PHP Security Vulnerability?

PHP processes requests sent to a web server, executes application code and returns the appropriate response. The newly disclosed vulnerabilities concern how PHP handles internal memory and request state while processing those requests.

CVE-2026-109618: Memory corruption

Under certain conditions, PHP can mishandle an out-of-memory situation while processing a request. This can leave internal data in an invalid state and potentially allow an attacker to execute code on the server.
CVE-2026-109619: Stale internal state

PHP can retain internal request-related state after the memory backing it has been freed. A subsequent request handled by the same worker may then use that stale state, potentially creating another route to remote code execution.

The practical concern is that successful exploitation may allow an attacker to run commands on the affected server without valid credentials. Depending on the server's permissions and configuration, this could expose website files, database credentials, customer information or other sensitive data.

The PHP security team has released fixes for both vulnerabilities. This is a PHP runtime issue, not a flaw that can be fixed simply by updating a WordPress theme or plugin.

Which PHP Versions Are Affected?

The vulnerabilities affect PHP installations serving web requests across multiple versions and server configurations. The official PHP project has published the following patched releases:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

If you are running an earlier release in one of these branches, update to the corresponding patched release or a later supported release containing the fixes. Linux distributions and hosting providers may also supply security-patched packages, so check their specific advisories rather than relying solely on the version number.

PHP 8.1 and older require particular attention. These versions are no longer supported by the main PHP project, although some operating system vendors may provide backported security fixes. If you are running an older version, contact your hosting provider or plan an upgrade to a supported PHP release.

PHP 8.2 is also approaching the end of its security support period on 31 December 2026. Although version 8.2.35 fixes these particular vulnerabilities, it is worth planning a move to a newer supported branch rather than leaving the upgrade until the last minute.

How to Check Whether Your Website Is Affected

The first step is to establish which PHP version your website actually uses. You do not necessarily need to be a developer to check this.

1. Check Your Hosting Control Panel

Log in to your hosting account and look for a section labelled PHP Version, PHP Manager, MultiPHP Manager or Software. The exact name depends on your provider.

Check the PHP version assigned to the affected domain, not simply the default version shown in your account. Some hosting accounts run different PHP versions for different websites.

2. Check WordPress Site Health

If you use WordPress, open your dashboard and navigate to Tools → Site Health → Info → Server. This section displays the PHP version reported by your WordPress installation.

If you have several WordPress websites, repeat this check for each one. Do not assume that every site under the same hosting account uses the same PHP configuration.

3. Ask Your Hosting Provider

If you cannot find the PHP version or are unsure whether your host has applied the security patches, contact its support team. Ask which PHP version your website is running, whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied, and whether you need to make any changes yourself.

If you manage your own server, remember that the version returned by the command php -v may belong to the command-line installation rather than the PHP runtime serving website requests. Check the active PHP-FPM, Apache, CGI or other web-serving configuration as well.

How to Fix the PHP Security Issue

The recommended solution is to install a security-patched version of PHP. The precise process depends on whether you use managed hosting, a virtual private server or your own infrastructure.

For Shared or Managed Hosting

Log in to your hosting control panel and check for PHP version updates.
Select an appropriate patched PHP version supported by your hosting provider and application.
If the provider manages PHP upgrades, ask them to confirm that the security fixes are installed and active for your domain.
Test the website after the change, including forms, login, checkout, contact submissions and any business-critical features.
Check scheduled tasks, integrations and background jobs where applicable, as these may use a different PHP configuration.

Do not assume that changing a dropdown automatically resolves the issue. Confirm the version serving actual web requests, and ask your provider whether any additional PHP workers or server instances need restarting.

For VPS, Dedicated Servers and Self-Managed Infrastructure

If you administer your own server, update the PHP packages through your operating system's supported package repositories or install the relevant fixed release using your established deployment process.

For example, on a Debian or Ubuntu system, an administrator would typically begin by refreshing the package index and reviewing available updates:

bash

sudo apt update
apt list --upgradable

These commands only refresh the package index and list available updates; they do not install the PHP security fix. The actual upgrade commands and package names depend on the distribution, repository and PHP version in use. Confirm that the relevant packages contain the security fixes before deploying them.

After updating, restart or reload the relevant PHP-FPM services or web server as required, verify the version used by web requests, and review application logs. If PHP is supplied by a container image, hosting platform or third-party appliance, update that component through its supported release process as well.

What If You Cannot Update PHP Immediately?

If you cannot apply the fix straight away, do not assume your website is safe simply because you have a firewall or security plugin installed. The PHP team has published temporary hardening measures, but these reduce exposure to particular attack paths and are not a replacement for updating.

The appropriate temporary configuration depends on your PHP version and server setup. The official advisory describes measures involving PHP memory handling, request-size limits and session upload progress. Some settings must be applied at the server or PHP-FPM pool level before request processing begins, and worker processes may need restarting.

Do not copy configuration changes from an unverified tutorial or apply them blindly to a production website. Incorrect settings can disrupt uploads, imports or other application functionality. Follow the official PHP advisory and have a server administrator assess the correct configuration.

The UK National Cyber Security Centre advises organisations to consider taking affected systems offline if they cannot update or apply effective temporary mitigations promptly. For an exposed business-critical application, speak to your hosting provider or security administrator immediately to decide how best to reduce risk.

Is Updating WordPress Enough?

No. WordPress runs on PHP, but these vulnerabilities affect the PHP runtime itself. Updating WordPress core, installing the latest plugins or changing your theme does not fix a vulnerable PHP installation.

WordPress site owners should still keep core, plugins and themes updated, remove software they no longer use, maintain reliable backups and use appropriate access controls. These are important security practices, but the immediate priority for this incident is to ensure that the underlying PHP installation is patched.

The same principle applies to Laravel applications and bespoke PHP software. Your application code may be perfectly maintained, but it still relies on the server's PHP runtime. Check the runtime and all environments where your application executes, including production workers and scheduled tasks.

What If Your Website Has Already Been Exposed?

Installing the patch prevents exploitation through these specific vulnerabilities on a correctly updated runtime, but it does not establish whether an attacker accessed the system before the update.

If your server was running a vulnerable version and was publicly accessible, review relevant web server, PHP, authentication and system logs for suspicious activity. Look for unexpected file changes, unfamiliar administrator accounts, modified scheduled tasks, suspicious processes and signs of unauthorised access to application or database credentials.

If you find evidence of compromise, or cannot confidently determine whether the system is clean, involve a qualified incident-response professional. Preserve relevant logs and evidence, isolate the affected system where appropriate, and rotate potentially exposed credentials from a trusted environment. Restoring a backup alone may not resolve a compromise if the backup already contains malicious changes.

For UK organisations, the National Cyber Security Centre provides further guidance on assessing and responding to this incident. Businesses with sensitive customer information or regulatory obligations should also follow their incident-response and reporting procedures.

A Simple PHP Security Checklist

Identify every website, application and server that uses PHP.
Check the PHP version actually serving each website.
Install the appropriate security-patched release or confirm that your provider has applied a verified backport.
Update all PHP runtimes used by workers, scheduled tasks and containers where applicable.
Test critical application functionality after the update.
Review logs and investigate possible compromise if a vulnerable server was publicly exposed.
Plan upgrades away from unsupported PHP versions.
Keep regular backups, access controls and monitoring in place.

The key lesson is that website security does not stop at the application itself. Keeping WordPress, Laravel, plugins and custom code up to date matters, but so does maintaining the server software underneath them.

If you are responsible for a website or business application and are unsure whether your PHP installation is protected, make checking it a priority rather than waiting for your next routine maintenance window.

Official Security Guidance

PHP security advisory: https://www.php.net/archive/2026.php
UK National Cyber Security Centre: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
WordPress security announcement: https://wordpress.org/news/2026/10/critical-php-security-release/