Critical PHP security update: what website owners need to do

Security briefing · 21 October 2026

A critical PHP security update needs attention from website owners, hosting providers and development teams. Two newly disclosed vulnerabilities can allow an attacker to run code on an affected server without signing in.

If your business relies on WordPress, WooCommerce or another PHP application, ask who maintains its PHP runtime today. Updating a plugin alone will not repair a flaw in the software that runs it. Yasa can assess the exposure, apply the appropriate fixes and verify that your website still works.

What is behind this PHP security update?

On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619. CERT-EU rates both vulnerabilities at 9.2 and recommends immediate patching. Its security advisory 2026-018 also warns that public technical details and early proof-of-concept code increase the urgency.

The first flaw concerns memory handling when a request runs out of memory. The second concerns internal request data that can survive after PHP has freed its memory. Under exploitable conditions, an attacker can turn these errors into remote code execution.

The practical impact depends on the application, configuration and permissions of the PHP process. A successful attack could put website files, application credentials and accessible business data at risk. It does not automatically give an attacker full control of every service on the machine.

Which PHP versions need updating?

The PHP project released the following patched versions. Use these or a later supported release in the same branch, unless your operating-system vendor documents an equivalent backported fix.

Linux distributions may keep an older base version while adding the security patches. For example, Ubuntu identifies 8.3.6-0ubuntu0.24.04.13 as fixed for Ubuntu 24.04. Check the full package revision against the Ubuntu security notice, rather than judging the first three numbers alone.

PHP 8.1 and older require particular care. Their upstream support has ended, although some vendors provide extended security maintenance. Confirm coverage with that vendor or plan a supported upgrade; an old version number is not evidence that a fix exists.

PHP-FPM and a login screen do not make the issue disappear

Apache with mod_php has the highest-risk demonstrated setup, but PHP-FPM is also affected. The PHP team documents an FPM exploitation path that depends on suitable application behaviour. Using FPM therefore changes the conditions of an attack; it does not remove the need to patch.

Likewise, a WordPress login, administration password or CDN is not a substitute for the PHP security update. A public request can reach PHP before the application decides whether the visitor may sign in. Check whether a proxy actually restricts direct access to the origin, too.

What website owners should do now

1. Ask for a runtime inventory. Include production, staging, webmail, background jobs and PHP bundled inside control panels. One server can run several versions.
2. Confirm the exact fix. Request the installed package revision and the vendor advisory that proves it contains both patches. A dashboard saying “up to date” may rely on stale package lists.
3. Preserve a usable recovery point. Back up the affected configuration and application data. Agree how to restore service if compatibility problems appear.
4. Update and replace running workers. Restart the affected PHP services and long-running PHP jobs. Installed files and processes already in memory can be different versions.
5. Test the business-critical journeys. Verify the website, administration, forms, checkout and integrations that matter to your business. Review errors after the update.

If a fixed package is not yet available, your provider should make an explicit containment decision. CERT-EU recommends considering isolation of exposed applications until they can be patched. Configuration workarounds address only some attack paths and need careful assessment; they are not a complete repair.

Do not test public exploit code against a production website to find out whether it is vulnerable. Version, package, configuration and routing evidence can establish the need to act without risking customer data or availability.

How Yasa helps with a PHP security update

We help businesses turn a security advisory into a practical maintenance job. Whether you need a second opinion on your hosting provider’s response or someone to carry out the update, we start with your actual environment and the services your business depends on.

For longer-term care, our support and development services can help keep maintenance visible and planned. If the work needs a dedicated technical specialist, rent a developer for the investigation and implementation. We agree the scope before making changes.

Common questions

Is updating WordPress enough?

No. WordPress, themes and plugins should be maintained, but these flaws are in PHP itself. The hosting provider or server administrator must update the runtime used by the website.

Does a patched server prove there was no breach?

No. Patching closes the addressed vulnerabilities; it does not establish what happened beforehand. If there are signs of intrusion, preserve logs and evidence and arrange a separate incident investigation.

Will the update take my website offline?

Restarting PHP workers can briefly interrupt requests. The exact impact depends on the hosting setup and application. A planned maintenance window, compatibility checks and a recovery procedure help manage that risk.

Get a clear next step

Not sure whether your website is covered?

Tell us your website address, hosting provider and what you need help with. We can discuss an exposure assessment, a controlled PHP update or ongoing maintenance.

Discuss your PHP security update ↗

Start with a consultation. Please do not send passwords or access tokens through the contact form.