PHP Security Vulnerability: 7 Steps Website Owners Should Take

Updated: 22 October 2026

The PHP security vulnerability announced on 21 October is serious, but website owners can take a clear first step: ask their hosting provider which PHP package serves the site and confirm that fixes for both reported flaws are active. The vulnerabilities can allow unauthenticated remote code execution on affected installations. This guide explains who may be affected, how to check your server, what to ask your host and what to test after patching.

PHP security vulnerability: what happened?

On 21 October 2026, the PHP project released security updates for CVE-2026-109618 and CVE-2026-109619. CERT-EU gives both a CVSS 4.0 score of 9.2 and says they may allow remote code execution without authentication. One flaw relates to memory corruption during out-of-memory handling; the other to stale internal state between requests. Website owners do not need to diagnose these code-level causes. The practical concern is that a request to a vulnerable PHP installation could potentially cause the server to run unauthorised code.

The announcement attracted additional attention because AI helped identify one flaw. OpenAI says Calif used GPT-5.6 Sol as part of its Patch the Planet initiative to identify a critical vulnerability; security company Wiz independently discovered and reported both flaws. PHP maintainers led the fixes and coordinated their release. This does not mean AI has attacked websites. It shows that established software can contain serious bugs until researchers uncover them.

Why PHP matters to WordPress websites

PHP is the server-side language WordPress uses to build pages and process requests. A PHP security update is applied to the hosting server, not through the WordPress Updates screen. Updating WordPress core, a theme or a plugin is sensible maintenance, but it does not replace a PHP runtime update. If your provider confirms that the PHP security vulnerability affects the package serving your domain, ask it to patch that runtime.

This PHP security vulnerability notice also does not prove that any particular WordPress site has been hacked. Exposure depends on the PHP package and server configuration actually serving your domain, and whether the hosting provider has applied the fix or a vendor backport. For help with your own site, contact your web developer or hosting provider.

Affected and fixed PHP versions

For the PHP security vulnerability announced on 21 October, the PHP project lists patched releases for these maintained branches:

• PHP 8.5: 8.5.12 or later within the branch
• PHP 8.4: 8.4.27 or later
• PHP 8.3: 8.3.36 or later
• PHP 8.2: 8.2.35 or later

Earlier releases in those branches are affected. PHP 8.1 and older are end-of-life in the PHP project and no longer receive its regular security fixes. Some hosting companies and operating-system vendors maintain their own packages and may backport a fix without changing the version number to match the upstream release. Ask your provider to confirm that the package serving your domain includes fixes for both CVEs; do not rely on a version label alone.

What should website owners do about the PHP security vulnerability?

1. Identify the runtime. Check your hosting dashboard or ask support which PHP version and package serve the affected domain. A site’s WordPress dashboard may display a version, but the host can confirm the active server package.
2. Ask about both fixes. Send this concise question: “Does the PHP runtime serving my domain include fixes for CVE-2026-109618 and CVE-2026-109619? If you applied a backport, please confirm the package and activation time.”
3. Apply the update. If your provider manages the server, ask them to patch it and confirm when the change is live. On a self-managed server, use the updated package supplied by your operating-system vendor or an appropriate fixed PHP release, then verify that the correct service restarted.
4. Back up and test. Keep a restorable backup. Use staging if available, especially before changing PHP branches. Older themes or plugins may need compatibility checks.
5. Check customer journeys. Test the home page, contact and enquiry forms, account sign-in, checkout or payments, bookings and any integrations your organisation relies on. Check on desktop and mobile.

Do not make unplanned production changes just to match an upstream version number. A maintained vendor package may include the security fix through a backport. What matters is that the patch is present in the runtime serving your domain.

What if the hosting provider cannot patch straight away?

CERT-EU advises organisations unable to patch promptly to consider isolating internet-facing applications from public networks until the fix is applied and verified. For a business website, discuss this with the hosting provider or server administrator, who can weigh the exposure against the operational impact of taking the service offline.

The PHP project says that updating is the complete fix. A WordPress plugin, hiding error messages or changing a setting in the dashboard cannot secure an affected PHP runtime. Temporary server configuration changes may reduce exposure to particular attack paths, but they are not a substitute for patching and can be misapplied. Follow the official advisory with a qualified administrator.

What to check after updating PHP

After the provider confirms the patch is active, test the pages and features customers use. If something fails, record the affected page and behaviour and report it to the host or developer. Do not return to a vulnerable runtime without discussing the risk first. Ask whether the provider has reviewed relevant security logs from the period before the fix.

A patch closes the known vulnerability in the updated runtime; it does not establish whether anyone accessed the server before then. If you see unfamiliar administrator accounts, unexpected redirects, unknown files or unusual outbound email, ask the host to investigate as a possible separate incident and preserve relevant logs.

PHP security vulnerability: frequently asked questions

What does the PHP security vulnerability mean for my business website?

If the affected PHP package serves your domain, your website may be exposed to unauthenticated code execution. That does not prove an attacker accessed it. Ask your provider to confirm the patch and review relevant logs.

Can I update PHP from the WordPress dashboard?

Usually not. WordPress may report the PHP version, but the server runtime is changed through your hosting control panel or by the hosting provider or server administrator.

Which PHP version should my website use now?

Use a supported branch compatible with your site and containing the security updates. The announced fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Confirm availability and compatibility with your host before switching.

My host says it applied a backport. Is that enough?

A vendor backport can contain the security fix without using the same version number as the upstream release. Ask the provider to confirm that its package includes fixes for CVE-2026-109618 and CVE-2026-109619.

Does running an affected version mean my site was hacked?

No. Exposure is not proof of compromise. Patch the runtime, then ask the provider to review relevant logs and advise whether an investigation is warranted.

Should I take my website offline?

First ask the provider to check your server. If it cannot patch the PHP security vulnerability promptly, discuss isolation or another temporary measure with the administrator responsible for your setup.

Official sources and further reading

• PHP project: security advisories and release information
• CERT-EU: Critical Vulnerabilities in PHP, Advisory 2026-018
• OpenAI: Patch the Planet and coordinated vulnerability response

This guide is general information for website owners, not a security audit of an individual server. The PHP project and the hosting provider are the authoritative sources for the package installed on a particular website.

Disclosure: AI tools assisted with the research and drafting of this article. The information has been checked against the official sources linked above.

This post is also available in: