Website Security

Critical PHP vulnerabilities: what they mean for your website

Illustration of a website and servers behind a cracked shield, representing a software security vulnerability.
WK Digital · October 2026 · 3 min read

A website can look and behave normally while the software behind it contains a serious security flaw. Two recently disclosed vulnerabilities in PHP are a reminder that website security extends beyond the pages visitors see.

PHP is server software used to run WordPress and many other websites and applications. The PHP project released security fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. Both can allow an attacker to execute code on an affected server without logging in. Read the official PHP advisory.

Who could be affected?

Anyone whose website or application uses an affected PHP build to serve web requests should check their hosting environment. This includes personal websites, online stores, business websites and custom applications, regardless of who hosts or manages them.

The risk extends beyond older websites. Recent PHP releases also required fixes, so a general description such as “PHP 8” does not establish that a site is patched.

What could happen if a flaw is exploited?

Remote code execution means an attacker may be able to make the server run instructions they control. Depending on the access available to the affected PHP process, the consequences could include:

  • Access to website files or information the application can read.
  • Changes to website content or the introduction of malicious code.
  • Disruption to enquiries, sales or other online services.

Those are potential consequences of a successful attack, rather than evidence that a particular website has been compromised. The PHP project’s first technical advisory and second technical advisory explain the underlying flaws.

What should website owners do now?

  1. Ask your host or server administrator to confirm the patch. Request confirmation that the PHP build actually serving your website includes fixes for both vulnerabilities. A working homepage is not a security check.
  2. Arrange the appropriate update promptly. The emergency PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Your administrator should check the latest appropriate release or the hosting vendor’s equivalent patched package.
  3. Check compatibility and important functions. Before a change, confirm a current backup and recovery plan. Afterwards, test the functions you rely on, such as forms, logins, bookings or checkout. WordPress provides guidance on preparing for a PHP update.

Some vendors have added the fixes to existing packages without changing the familiar PHP version number. Ask for confirmation of the full package or build, rather than relying only on the number displayed in a dashboard. Plesk documents examples of these patched builds.

For WordPress websites, updating WordPress, themes and plugins remains important, but it does not replace the PHP patch on the hosting server. Sites using an older PHP branch should also establish whether vendor security support is available and plan a tested move to a supported branch.

If there are signs of compromise, ask your provider to investigate as well as patching the software. An update closes a vulnerability; it does not establish whether an earlier intrusion has left anything behind.

If you have concerns about your website, you’re welcome to book a chat with WK Digital.