Critical PHP Vulnerabilities in 2026: What Website Owners Must Do Now

Your website may look fine and still be running a vulnerable PHP server. Here is how to check, patch and protect it—without putting your business at unnecessary risk.

What happened in the October 2026 PHP security incident?

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both can lead to unauthenticated remote code execution in vulnerable web-serving configurations. That means an attacker may be able to run code on a server without first signing in. This is a server-side PHP issue, not simply a WordPress plugin bug.

The official PHP advisory names PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. Linux distributions and long-term-support vendors may ship the fixes as backported packages with different version strings. The safest approach is to verify the actual security patch status with your hosting provider rather than assume that the version number alone tells the whole story.

What are the two PHP vulnerabilities?

CVE-2026-109618: memory-handling corruption

This flaw concerns PHP handling an out-of-memory condition while request data is only partly initialized. Later cleanup may treat invalid internal data as valid. In a vulnerable configuration, a specially crafted web request may trigger the flaw before application code even runs.

CVE-2026-109619: stale state between requests

This flaw concerns internal request state that survives after its underlying memory has been freed. When a worker processes a later request, stale data may be used before initialization has safely reset it. This can create an opportunity for code execution. Neither issue requires a website owner to have installed a malicious plugin.

Which websites are affected?

The PHP project identifies web-serving installations including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially at risk. It identifies particularly high risk for mod_php, where a demonstrated attack can occur before the application starts. Actual exposure depends on server configuration, patch status and other protections.

WordPress, WooCommerce, Drupal, Joomla and custom PHP websites deserve immediate review because they commonly run on PHP. This does not mean every installation of those products has been compromised, or that every PHP website can be exploited in the same way.

Fixed PHP releases

PHP Branch Fixed Releases

PHP branch	Fixed release
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

PHP 8.1 and older no longer receive normal security releases from the PHP project. Some vendors provide backported fixes; the PHP security team also published limited source backports for 7.4, 8.0 and 8.1. Those measures should not be mistaken for restoring normal upstream support. Plan migration to a supported PHP branch.

What could happen if a website is exploited?

• Unauthorized access to files, configuration secrets or databases, depending on server privileges.
• Changes to website content, payment pages or form submissions.
• Malware installation, spam distribution or use of the server to attack other systems.
• Website outages, recovery costs and loss of customer confidence.
• Potential disclosure of personal or business data, requiring an incident response and legal assessment.

The damage depends heavily on the permissions granted to the PHP process. A tightly restricted service account may limit the blast radius. A poorly isolated shared server or highly privileged process can make an incident much worse.

How could attackers exploit these flaws?

At a high level, an attacker can send crafted HTTP requests to a vulnerable PHP-powered server. One flaw targets memory handling during request processing; the other targets unsafe internal state across requests. A successful exploit can allow attacker-controlled code to run under the permissions of the PHP service. No stolen WordPress password is necessarily required.

Public disclosure and emergency patches can also help attackers identify what to look for on unpatched servers. That is why speed matters. A firewall or content delivery network may reduce some attack traffic, but it is not a substitute for the PHP fix. Do not test production sites using exploit scripts downloaded from unknown sources.

What should business website owners do right now?

Identify every PHP-powered website and the hosting account responsible for it. Include staging sites and older microsites.
Ask your hosting provider whether the October 2026 fixes for both CVEs have been installed, including any vendor backports.
Create a verified off-site backup of website files and databases before making changes.
Apply the appropriate patched PHP release or vendor security package. Test compatibility on staging when possible.
Update WordPress core, plugins and themes separately; those updates do not replace the PHP security patch.
Check logs, admin accounts, scheduled tasks, unexpected file changes and outbound activity for suspicious behavior.
Test forms, checkout, booking tools, login, email delivery and other revenue-critical functions after updating.
Document who performed the update, the time, the patch status and any suspicious findings.

If your host cannot patch an exposed vulnerable system promptly, discuss temporary isolation or taking it offline until remediation is possible. That may be inconvenient, but an unprotected production server can create a larger business problem. If compromise is suspected, preserve logs and seek incident-response assistance before making sweeping changes.

Entrustech can help review your website environment, coordinate with hosting support and build a practical update and monitoring plan. Related Service: (Insert Entrustech website security and maintenance page URL).

DIY website owners: how to check your PHP version and take action

If you built your own site with WordPress, a page builder or a low-cost hosting plan, you can do the first checks yourself. You do not need to understand PHP code. You do need access to your WordPress dashboard or hosting control panel.

Step 1: Find the PHP version in WordPress

Sign in to your WordPress administrator dashboard.
Go to Tools → Site Health → Info.
Expand the Server section and locate PHP version.
Write down the version and take a screenshot for your records.

If you cannot see Site Health, sign in to your hosting panel. In cPanel, look for MultiPHP Manager or Select PHP Version; in managed hosting, look for PHP Settings or contact support. Menu names vary by provider.

Step 2: Check whether your installation is patched

Compare the reported version against the fixed release table above. If it appears older, do not assume it is safe. Also do not assume a vendor-backported installation is unsafe solely because its displayed version looks older. Ask support to confirm coverage for CVE-2026-109618 and CVE-2026-109619 in writing.

Step 3: Back up and update safely

Download or confirm a working backup of files and database.
Check that your theme, plugins and integrations support the target PHP branch.
Use a staging copy if available, then select the patched PHP release or ask the host to apply it.
Visit the homepage and important pages; submit a test contact form and test checkout if applicable.
If something breaks, contact support or your developer. Avoid switching back to an unpatched version as a permanent fix.

Step 4: Watch for warning signs

• Unexpected administrator accounts or password-reset emails.
• New redirects, unfamiliar pages or spam appearing in search results.
• Sudden changes in site files, unusual server activity or unexplained downtime.
• Customer complaints about payment, login or form behavior.

These signs do not prove that this specific PHP flaw was exploited. They are reasons to investigate. If your host handles PHP updates automatically, request confirmation that the relevant security fixes have actually reached your account.

Not comfortable changing server settings? Request an Entrustech website security review before making changes to a live business website. A short review can prevent a hurried update from interrupting leads or sales.

Is updating WordPress enough?

No. WordPress core, themes and plugins sit above the PHP runtime. Updating them is good security hygiene, but it does not install a PHP runtime patch. Conversely, updating PHP does not fix an outdated plugin with its own vulnerability. Treat these as separate layers of maintenance.

What about temporary workarounds?

The PHP project lists configuration changes that may reduce exposure to specific known attack paths, including adjustments to request-size limits and selected PHP settings. It explicitly warns that these are not complete fixes. Some suggested memory settings can affect server stability, so they should only be evaluated by qualified administrators who understand the application and hosting limits.

For most small-business owners, the right decision is simpler: get the supported security update installed, verify it, and keep the site monitored. Do not copy emergency server-configuration commands from social posts into production.

A practical website security checklist for the next 30 days

• Today: confirm the PHP patch status with your host and back up the site.
• Within 48 hours: finish patching, compatibility testing and a basic log review.
• This week: audit admin accounts, plugins, themes, access permissions and backup restoration.
• This month: set a documented update schedule, uptime monitoring and a clear emergency contact.

Website security is not a one-time upgrade. For businesses that rely on online leads, appointments or sales, maintenance is part of protecting revenue. Related Blog: (Insert Entrustech WordPress maintenance article URL).

Frequently Asked Questions:

Is my WordPress website automatically vulnerable?

Can someone attack my site without a password?

Which PHP versions contain the fixes?

Can I fix this by updating plugins?

Will changing PHP versions break my website?

What if my hosting company manages PHP?

Should I take my website offline?

Does a website firewall solve the problem?

How can I tell if someone already hacked my site?

Do I need to move to a new hosting provider?

Protect the website your customers rely on

The October 2026 PHP vulnerabilities are a reminder that a website can look perfectly normal while its underlying software needs urgent attention. Check your PHP version, verify the actual patch status, test carefully and document what changed. If you would rather have an experienced team review the risks and coordinate fixes, contact Entrustech to request a website security audit or maintenance consultation.

Verified sources and further reading

Editorial note: Security information is current as of October 23, 2026. Patch and exploitation status can change. Confirm with your hosting vendor before making server changes.