The key idea
A website can look fine and still need an urgent update. Ask your provider to confirm that PHP is patched, test the site's key functions and agree who is responsible for ongoing maintenance.
Reviewed on October 25, 2026. Includes the additional advisory published by PHP on October 23.
Your website loads. The logo is in the right place, and the contact form seems to work. Everything looks normal. Yet some of the software behind it may need an urgent security fix.
That is why PHP vulnerabilities matter to business owners, even if they have never written a line of code. On 21 October 2026, PHP released updates for two critical flaws that, under certain conditions, could let an attacker run instructions on a server without logging in. Official PHP security advisory.
If your business runs a WordPress website or an application built with PHP, ask whoever manages it to confirm that the fixes are in place. Understanding what happened will help you ask specific questions and decide what to do next.
The October 23 PHP advisory: what to check
The PHP project reported another risk, tracked as CVE-2026-115560, involving an uncommon interaction between application code and configuration. It said the full advisory would accompany the next regular release.
Ask your provider to check whether your site meets those conditions and follow the advisory’s measures. This check is additional to the October 21 patches. Additional PHP project advisory · Updated CERT-EU advisory.
What PHP does behind your website
PHP is a programming language that helps websites process information, generate pages and connect features to a database. It is part of the technology that WordPress relies on.
Think of your website as a shop. Visitors see its design, but behind the scenes, other systems keep it running. A fresh coat of paint can improve the storefront while the wiring still needs attention.
Different parts may also have different people responsible for them. WordPress manages content, plugins add features, and your hosting provider runs the environment where the site lives. PHP is managed at server level, so updating WordPress and updating PHP are separate tasks. WordPress documentation on PHP.
What happened with PHP vulnerabilities in October 2026
The two flaws are identified as CVE-2026-109618 and CVE-2026-109619. These reference numbers tell your provider exactly which issues to check.
The advisory covers PHP installations that handle web requests and identifies a particularly high risk in one Apache configuration. The recommendation is to update immediately: temporary measures reduce some risks but do not replace the fixes. Scope of the CERT-EU advisory.
These are the fixed versions released on 21 October:
- PHP 8.2: fixed version 8.2.35.
- PHP 8.3: fixed version 8.3.36.
- PHP 8.4: fixed version 8.4.27.
- PHP 8.5: fixed version 8.5.12.
Some providers include the fixes in their own software packages without displaying those exact version numbers. Ask them to confirm the applied security fix, also called a patch, as well as the version. This list relates to the October advisory; check the project and your provider for later updates. Official fixes and update instructions.
The story behind the urgent release
The PHP Foundation explained that early signs of one problem appeared during work following a 2024 audit. Fixing it proved difficult because of its effects on compatibility and operation. The Foundation acknowledged problems with its processes and resources. Later research demonstrated the extent of the risk.
A leak disrupted the coordinated announcement and brought the release forward from 22 to 21 October 2026. The case shows how much work can sit behind what arrives in a website owner's inbox as a simple update notice. The PHP Foundation's account.
There had been earlier issues with a different scope. In June 2024, CVE-2024-4577 affected certain PHP installations on Windows using Apache and PHP-CGI. CERT-EU reported active exploitation at the time. Each advisory has its own conditions: that earlier issue did not affect every PHP website in the same way. CERT-EU's 2024 advisory.
What a website security flaw could mean for your business
A vulnerability is a flaw that someone could exploit to interfere with a system or access information without permission. Its existence does not prove that someone has broken into your website. A successful attack could lead to unauthorized changes, exposure of information accessible through the system or service interruptions.
Consider a company paying for ads to generate inquiries. If its form stops working, visitors may still arrive while business opportunities disappear. For an online store, an interruption can affect purchases and create extra work for customer support.
Trust is also at stake. Google explains that websites with certain security problems may display warnings in search results or when someone tries to visit them. Those warnings can make it harder for customers to reach your business. Search Console's Security Issues report.
Keep that risk separate from an SEO promise: updating PHP addresses specific technical issues. It does not, by itself, guarantee higher Google rankings.
How to tell whether your website needs a PHP update
Start by asking whoever manages your website for four clear answers:
- Which PHP version serves the website your visitors actually use? If you have several sites or subdomains, ask for each one to be checked.
- Have the October fixes been applied? An answer such as “we use PHP 8” does not identify the patch.
- How long will that release series, such as PHP 8.2, receive support? Software can continue to work after its official maintenance ends.
- Who will check the result? Someone needs to test the important functions after the update.
As of 22 October 2026, PHP 8.2 receives official security support until 31 December 2026. PHP 8.1 and earlier versions have already reached the end of their regular official support. Some providers offer additional maintenance; confirm what it covers and which fixes they supply. PHP's official support schedule.
You can send this message to your hosting provider or website administrator:
Please confirm whether my website has the fixes for CVE-2026-109618 and CVE-2026-109619. I need to know which PHP version serves the live website, which patch has been applied, when it was installed and who will test the forms and other important functions.
How to update PHP and check that your website still works
For this critical advisory, contact the person responsible promptly so they can apply and verify the fixes. Preparation should support that urgent response.
Ask for a scope of work that includes:
- A recoverable backup of files and the database. Everyone should know how it would be restored if needed.
- A compatibility review. This matters particularly for older plugins, an unmaintained theme or custom development.
- The security update. Your provider should confirm what changed and where.
- Tests of important business functions. Submit a form and confirm it arrives. Check logins, bookings or purchases as appropriate. Payments should be checked through an agreed test procedure.
- A check after the update. Review errors and confirm that the website is using the fixed software.
WordPress recommends preparing backups and checking compatibility before changing PHP. Installing a fix within PHP 8.2 and moving from PHP 8.2 to PHP 8.4 can involve different work. Your quote should explain which you need. Preparing for a PHP update in WordPress.
If you have already noticed unexpected changes, unfamiliar users or redirects to other websites, mention those signs at the outset. Applying a patch does not, by itself, remove changes an intruder may have left behind.
Beyond PHP: what website maintenance should cover
WordPress security and business website security depend on several components. Alongside PHP, review:
- Your content management system, plugins and theme. Keeping them updated and removing unnecessary components reduces potential entry points.
- Access. Give each person the permissions they need, use strong passwords and enable additional verification where available.
- Hosting. Make clear what your provider maintains and what your website administrator is responsible for.
- Backups and recovery. Stored backups are useful when there is also a tested way to restore them.
- Alerts and logs. Someone needs to receive them and know when to act.
These measures form part of the approach to reducing risk described in the WordPress security guide. When choosing a website maintenance service, ask for specific deliverables: what they check, what they update, how they test the result and how they handle an incident.
Frequently asked questions about outdated PHP and website security
Has my website been hacked because it uses a vulnerable version?
The version indicates exposure to a known issue. Confirming an intrusion requires investigating the website and its logs. Address the update even if there are no visible signs of a problem.
Does updating WordPress also update PHP?
They are separate components. PHP is managed on the server and usually requires action from your hosting provider or whoever administers that environment.
Can a security plugin replace the patch?
For the two October 21, 2026 vulnerabilities, PHP states that updating is the complete fix. Ask for the patch to be applied even if your website has other protections.
How much does it cost to update PHP or fix a vulnerable website?
That depends on whether the work involves a simple patch, adapting older features, replacing plugins or investigating an intrusion. Ask for an assessment and a quote that separates those tasks, the testing and ongoing maintenance.
Do I need to replace my entire website?
A vulnerability alone is not enough to justify a rebuild. First, establish the condition of the website. If it depends on abandoned components or has accumulated compatibility problems, compare the work needed to update it with the work involved in rebuilding it.
The next step for your business website
Start by getting confirmation that the patch is applied and checking that important functions still work. Then agree who will maintain the website and how they will report the work.
If the review reveals compatibility problems or a need to rebuild, tell us what is happening with your website. We can help define the design and development work your business needs. You can also explore our websites and landing pages.
