Critical PHP Vulnerabilities: Update Your Website Now

Website administrators are being urged to act immediately after two critical vulnerabilities were discovered in PHP, one of the technologies powering a large portion of the internet.

On October 21, 2026, the PHP development team released emergency security updates addressing two vulnerabilities that could allow unauthenticated attackers to execute malicious code on vulnerable servers. The warning affects PHP installations running websites and applications, including WordPress sites.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.

The danger is that an attacker may be able to exploit a vulnerable server without first logging in to the website. Depending on the server configuration and the permissions available to the compromised process, successful exploitation could put website files, application data and other systems at risk.

The PHP team has urged users to update immediately, warning that there is no complete workaround that replaces installing the security fixes.

What Is PHP and Why Does This Matter?

PHP is a server-side programming language used to build websites and web applications. When a visitor opens a page, PHP can process requests, communicate with databases, manage accounts and generate the content delivered to the browser.

It powers major platforms and content management systems, including WordPress, as well as countless custom websites, online stores and hosting applications.

That widespread use means a serious vulnerability in PHP can have consequences far beyond one website or company.

Unlike a flaw in an individual WordPress plugin, these vulnerabilities affect the underlying technology that executes website code. Updating WordPress itself does not fix a vulnerable PHP runtime.

Two Critical Vulnerabilities Explained

The PHP project published security updates addressing CVE-2026-109618 and CVE-2026-109619.

The vulnerabilities have been reported as capable of enabling remote code execution without authentication. In practical terms, this means a remote attacker may be able to make a vulnerable server execute instructions without first obtaining a legitimate account.

If an attack succeeds, the consequences depend on the environment. Potential risks include:

• Unauthorised access to website files and application data.
• Modification of website content or files.
• Theft of credentials or other secrets accessible to the affected process.
• Installation of malicious scripts or backdoors.
• Further attacks against connected services, depending on the server’s permissions and network access.

These are potential consequences of successful exploitation, not confirmation that every vulnerable website has been compromised.

Reuters reported that the vulnerabilities prompted urgent action by administrators, including some government organisations that temporarily took services offline while addressing the risk.

Which PHP Versions Have Been Patched?

The PHP development team released the following security versions on October 21, 2026.

Administrators should check the official PHP security advisory and their operating system or hosting provider’s update guidance to determine the correct package for their environment.

PHP versions older than 8.2 are no longer supported by the main PHP project and do not receive these official security fixes. Older installations may require migration to a supported version or a verified security update from a third-party provider.

Important: Do not assume that your website is protected simply because it runs WordPress or has recently updated its plugins. The PHP version running on the server must also be addressed.

Why WordPress Websites Need to Pay Attention

WordPress uses PHP to execute its core software, themes and plugins. This makes the PHP security release particularly important for website owners and hosting providers.

The WordPress project has published its own warning and confirmed that the issue is not specific to WordPress. No WordPress core update is required to fix these particular PHP vulnerabilities; the necessary action is to update the PHP runtime.

Website owners should:

1. Check the PHP version used by their website.
2. Contact their hosting provider if the patched version is unavailable.
3. Verify that all relevant PHP handlers and installations are updated.
4. Back up website files and databases before planned version changes.
5. Review logs and security alerts for suspicious activity.
6. Check that backups are usable and that administrator credentials are protected.

For WordPress, the PHP version can be viewed under Tools → Site Health → Info → Server in the dashboard. Hosting panels such as Plesk may also show the PHP version assigned to each website.

What About Older Servers?

Older operating systems and PHP installations require particular attention.

A server running an obsolete PHP branch may not receive security fixes from the official PHP project. Installing a newer WordPress version or updating a security plugin will not resolve that underlying problem.

Upgrading PHP can also require compatibility testing. Older plugins, themes and custom applications may rely on features that have changed between PHP versions.

Administrators should therefore plan a controlled upgrade, test critical functionality and ensure they have working backups. If a vulnerable production server cannot be secured promptly, follow official security guidance about restricting access or temporarily taking the affected service offline.

Do not leave an exposed, vulnerable PHP installation running indefinitely while waiting for a convenient maintenance window.

How to Check Whether Your Website Is Protected

Website owners do not need to be PHP developers to begin checking their exposure.

For hosted WordPress websites:

• Open the WordPress dashboard and navigate to Tools → Site Health → Info → Server.
• Record the PHP version shown.
• Compare it with the patched releases listed above.
• Ask the hosting provider to confirm that the relevant PHP runtime has been updated.

For Plesk users:

• Open Websites & Domains.
• Select the relevant domain and open PHP Settings.
• Check the assigned PHP version and handler.
• Check any other domains or services hosted on the same server.
• Confirm with the server administrator that the underlying packages and PHP services are patched.

Changing a domain’s PHP selector alone may not update every PHP installation on a server. Administrators should verify the actual runtime and handler used to serve requests.

Has the Vulnerability Already Been Exploited?

The release has triggered urgent warnings because the vulnerabilities could allow unauthenticated remote code execution.

However, the existence of a critical vulnerability does not automatically mean that every unpatched website has been attacked. Nor does updating PHP prove that a system was never compromised before the update.

Administrators should monitor official advisories for confirmed exploitation reports and investigate unusual activity where appropriate. If there are credible signs of a breach, preserve logs, isolate affected systems when necessary, rotate potentially exposed credentials and follow an incident-response process.

Security updates should be installed promptly even if no suspicious activity has been observed.

The Bottom Line

The October 21 PHP security release is a reminder that website security depends on more than WordPress core, plugins and themes. The software underneath a website needs to be maintained as well.

The PHP project has released patched versions for its supported branches and strongly recommends immediate updates. Website owners should verify their PHP versions, work with their hosting providers and avoid leaving unsupported installations exposed to the internet.

For administrators, the priority is straightforward: check your PHP version, apply the appropriate security update and verify that the vulnerable runtime is no longer serving requests.

Official sources

• PHP official website and security release information
• PHP security release announcements
• WordPress: Critical PHP Security Release — October 21, 2026
• Reuters: PHP developers issue new versions fixing critical vulnerabilities

This article reflects the security information published on October 21, 2026. Administrators should consult official advisories for the latest remediation guidance and package availability.