0429 109 328 Order now

A critical PHP security fix lands this week: what it means for your website

PHP is the programming language running quietly behind a great many business websites. WordPress, WooCommerce, Drupal and Magento (Adobe Commerce) all sit on top of it, and so do most sites on shared hosting. Many owners have never been told which version they run, and this week is the one where that matters.

What happened

The PHP project released its security fix on Wednesday 21 October 2026, scheduled for 14:00 UTC (1:00 AM on Thursday 22 October in Sydney). It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and both score 9.2 on the CVSS v4.0 scale. PHP says both can allow unauthenticated remote code execution, which in plain terms means a stranger with no login may be able to run their own code on the server that hosts your site. PHP's notice also says there are no complete mitigations: updating is the only safe choice.

The CVE numbers and claimed exploit details began circulating online on 20 October, before the patch was released. Tenable notes that exploit code is going around but that it has not verified any of it, so treat anything you download with care. You may see a 10.0 score going around online, but the official figure is 9.2. That is still serious, and there is no need to panic about it. Tenable also reports that Cloudflare's CTO, Dane Knecht, said on 21 October that Cloudflare was "seeing early attacks emerging". That is a report of early attacks, not confirmed exploitation. Security firm watchTowr says it is seeing attempts to exploit both flaws.

The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older: no official release from the PHP project, so ask your host.

Why it flows on to your business

There are two ways this can go wrong for a website owner.

The first is the patch itself. When your host updates PHP, an older plugin or theme that was never written for the new version can stop working, and the usual result is a white screen where your site used to be.

The second is the host that does not patch. The PHP project made official releases only for the versions it still supports, 8.2 to 8.5. PHP 8.1 and older no longer receive updates from the PHP project, so there is no official release for them. The security team did publish minimal source backports for PHP 7.4, 8.0 and 8.1, for people who build PHP from source, and some Linux distributions and long-term-support vendors may backport the fix, so whether an older site is covered depends on its host. PHP 8.2 gets no security fixes after 31 December 2026. A site that nobody patches by hand or moves up to a supported version may stay open, and exploits tend to arrive before many hosts have patched anyway.

What to do this week

  • Find out which PHP version your site runs. Your hosting control panel normally shows it, or your host can tell you.
  • Ask your host in writing whether the October fix has been applied to your account, and keep the reply.
  • Test on a staging copy (a private duplicate of your site) before you update anything live.
  • Look for files you did not put there, such as odd names in your uploads folder or pages you do not recognise.

How we can help

Big or small, we have you covered. If you are not sure which PHP version your site runs, or whether it still gets security fixes, ask us for a check. Email chris@combinationsoupstudio.com.au with your business name and website address, or text them to 0429 109 328 if that is easier.

The version matters. On an end-of-life version there is no official release from PHP. On a supported version a fix exists, and the question is whether your host has applied it, which nobody can see from the outside. If your site is not on PHP at all, this one does not affect you.

Our Site Check is a full check of your site from the outside, no logins needed, including the PHP version where it is visible and whether that version still gets fixes. You get a written report and recommendations by the next business day after payment, and it is paid up front. What it cannot confirm is whether your host has applied the October fix: only your host can tell you that, so ask them in writing.

If nobody has been looking out for your site, let us change that. That might be a fixed-up site, a new one, or hosting and care with us, where you hear about things like this from us before your host mentions it.

Sources: php.net, Tenable, Help Net Security, watchTowr, Huntress, runZero, Private DevOps.