Home / Guides / Website Security
Website Security · 4 min readCritical PHP Security Update (October 2026): What to Do Now
PHP fixed two critical security holes on October 21, 2026. Learn which PHP versions are safe, how to check yours, and what to ask your web host today.
On October 21, 2026, PHP released urgent security updates for two critical holes, and every website running PHP should be on a fixed version now. The safe versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer (PHP.net, Oct 21 2026). This post explains what the problem is, who is at risk and the exact steps to take today.
What is PHP, and why does this matter?
PHP is the programming language that runs on your web server and builds your pages. WordPress, WooCommerce, Drupal, Joomla, Laravel and many custom sites all use it. You don't see PHP, but every page load depends on it.
Because PHP sits on the server, it is updated separately from your website software. Your host, or whoever runs your server, does that job.
What is the hole, in everyday words?
The two problems are listed as CVE-2026-109618 and CVE-2026-109619. A CVE is a public ID number for a known security hole.
Think of PHP handling a web request like a cook using a shared kitchen counter. Each order should start on a clean counter.
- The first hole is about what happens when PHP runs out of memory partway through a job. It can stop with the counter half set up, and the cleanup can trip over that mess (CVE.org, Oct 21 2026).
- The second hole is about leftover notes from one order that don't get wiped, so the next order can read things that should be gone (CVE.org, Oct 21 2026).
The PHP team rated both 9.2 out of 10 and said they "can allow unauthenticated remote code execution." Remote code execution means an outsider could run their own commands on your server. Unauthenticated means they don't need to log in first.
We won't go deeper than that. The important part is the fix.
Who is at risk?
According to the PHP team, the fixed versions cover the supported branches 8.2, 8.3, 8.4 and 8.5. Their advisory names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed setups, and says risk is highest for mod_php (PHP.net, Oct 21 2026).
On October 26, CISA added both holes to its Known Exploited Vulnerabilities list (CISA KEV, Oct 26 2026). That list is for flaws with evidence of use in real attacks.
PHP 8.1 and older don't get updates from the PHP project at all. If you are on one of those, you are not covered by this fix.
How to check your PHP version
In WordPress:
- Log in to your dashboard.
- Go to Tools, then Site Health.
- Click the Info tab and open Server.
- Look at the PHP version line.
This is the path WordPress.org gives in its own notice (WordPress.org, Oct 21 2026). On other sites, check your hosting control panel (often under "PHP settings" or "Select PHP version").
Compare your number to this list:
- 8.5.x: need 8.5.12 or newer
- 8.4.x: need 8.4.27 or newer
- 8.3.x: need 8.3.36 or newer
- 8.2.x: need 8.2.35 or newer
- 8.1 or lower: no fix from PHP; plan a move to 8.3 or newer
What to do today
- Back up your site (files and database).
- Message your host. Ask: "Is my PHP updated for CVE-2026-109618 and CVE-2026-109619?" Many hosts patch for you. WordPress.org says hosts may already be updating and adding firewall rules, but you should confirm.
- If you manage your own server, install the fixed PHP from your system's package source, then restart PHP-FPM or your web server so the new version actually loads.
- Check the version again in Site Health to make sure it changed.
- Test the site: home page, forms, logins, checkout.
There is no setting that fully blocks this. The PHP team said: "There are no complete mitigations, updating is the only safe choice."
WordPress.org also passes on advice from cybersecurity agencies: if you run an old version on your own server and can't update right away, consider taking the site offline until you can.
Related PHP notices this month
- On October 23, PHP posted an informational notice about session upload progress (CVE-2026-115560), calling it "an unlikely RCE vector." It only matters for apps that change one session setting at runtime. A full fix comes in the next regular release (PHP.net, Oct 23 2026).
- On October 26, PHP rebuilt its Windows packages to update a compression library. The PHP version numbers stayed the same.
Plan for PHP 8.2's end of life
PHP 8.2 stops getting security fixes on December 31, 2026. If you are on 8.2, now is a good time to plan your move. Check that your theme and plugins support a newer PHP first. Our guide to keeping WordPress and PHP patched walks through doing this safely, and our October roundup lists the other fixes from this month.
When to call for help
Get help if your host hasn't updated, if your site breaks after the PHP change, or if you see users, files or redirects you don't recognise. Those signs need a closer look.
How Social Buzz can help
We check your PHP version, work with your host to update it, test your site on the new version and fix anything that breaks. If you want a second pair of eyes this week, see our website security service or email info@social-buzz.app.
Questions people ask
Which PHP versions fix the October 2026 critical holes?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released October 21, 2026. Any newer version in the same branch is also fixed.
Do I need to update WordPress to fix the PHP problem?
No. WordPress.org says these holes affect any server running PHP and no WordPress update is needed. You or your host must update PHP itself.
Is there a setting that blocks the PHP holes without updating?
No. The PHP team said there are no complete mitigations and updating is the only safe choice.
Are these PHP holes being used in real attacks?
CISA added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities list on October 26, 2026. That list only includes flaws with evidence of real-world use.
Patch, harden and watch your PHP and WordPress site.
Old PHP versions, outdated WordPress plugins and weak logins are common ways websites get broken into. We update and patch your site, close common gaps, and watch it so problems are caught early.
See how we help →