Critical PHP Vulnerabilities: Which Versions to Update Today and How to Protect Your Website

On October 21, 2026, the PHP team issued an urgent security advisory regarding two critical PHP vulnerabilities that may enable the Remote code execution without authentication. In simple terms: an attacker could take control of the server hosting a website without needing a username or password. The official solution is to update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on which branch your site uses.

The issue isn't with a specific plugin, theme, or template, but with the PHP engine itself. That's why it affects WordPress sites, WooCommerce stores, custom systems, and any web application that relies on PHP. If you run an online business or manage client websites, this is an update you should check today—not during your next monthly maintenance window.

PHP Vulnerabilities from October 21: In a Nutshell

• PHP fixed two critical vulnerabilities identified as CVE-2026-109618 y CVE-2026-109619, both with a CVSS 4.0 score of 9.2 out of 10.
• They may allow an attacker to execute code on the server without logging in.
• They affect PHP installations that handle web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
• The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• PHP 8.1 and earlier versions no longer receive official updates from the PHP project.
• Temporary measures reduce exposure, but according to the official notice itself do not ensure a safe installation: Updating is the only complete solution.

What PHP vulnerabilities were disclosed today?

PHP is the language that powers a large portion of the world's websites, including WordPress. Every time someone opens a page, submits a form, or uploads a file, PHP processes that request on the server. The two disclosed vulnerabilities affect precisely that stage of processing.

CVE-2026-109618: The Out-of-Memory Vulnerability

PHP limits the amount of memory each request can use to protect the server. The problem arises when that limit is reached while PHP is still processing the request data—for example, when receiving a form with attachments. At that point, the subsequent cleanup process may treat incomplete information as valid. According to the security advisory, a malicious actor could intentionally trigger this situation using specially crafted requests.

CVE-2026-109619: The Residual Information Vulnerability

Servers reuse the same PHP processes to handle many consecutive requests. This vulnerability occurs when a critical error interrupts a request before PHP has had a chance to clear certain internal information. The next request handled by that same process may encounter these remnants and use them before the system resets them. With the right preparation, this can lead to remote code execution.

In some security reports, these vulnerabilities are referred to by the informal name «PHP2Shell.» The official PHP advisory does not use that name; the correct references for finding patches and confirming with your provider are the two CVE identifiers.

Who Is at Risk from These PHP Vulnerabilities?

The official notice states that they are on display all PHP installations that handle web requests. That includes the most common ways to run PHP on servers and hosting plans: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The PHP team believes the risk is greater in Apache with mod_php, because it demonstrated an attack in which a single unauthenticated request can trigger the vulnerability before any application code is executed. In other words, keeping WordPress, plugins, and themes up to date does not protect against this issue if the server’s PHP version remains vulnerable. In terms of WordPress security, the priority today is not the site’s front end, but the server.

For a business, the risk isn't just technical. A compromised server can lead to customer data theft, redirects to fraudulent sites, spam sent from your domain, website outages in the middle of a campaign, or security warnings on search engines that harm your reputation and search rankings.

Affected PHP versions and fixed versions

Given the severity of the issue, the PHP security team released minimal source code patches for PHP 7.4, 8.0, and 8.1. However, these are intended for those who compile PHP on their own; they do not replace a supported version. If your site is still running on one of those branches, the underlying problem is more serious than these two vulnerabilities. We explain why in the guide on Why You Should Keep Your Server's PHP Version Up to Date.

How to Find Out Which Version of PHP Your Website Uses

To find out if the PHP vulnerabilities affect your site, the first thing you need to know is which version is installed. You don't need any technical knowledge to check this. If your site runs on WordPress:

1. Log in to the WordPress dashboard using an administrator account.
2. Go to Tools > Site Health.
3. Open the tab Information.
4. Expand the section Server and search for the data PHP Version.

If your site doesn't use WordPress, check the control panel for your hosting plan—where you'll usually find a selector or indicator for the PHP version—or ask your provider or the person who manages the server directly.

If the version number hasn't changed, that doesn't always mean you're still vulnerable.

The official announcement states that Linux distributions and vendors offering extended support received the patches in advance. Some of them apply the fix to their own packaged version without changing the major version number. Therefore, if you see a version older than the fixed ones, the right question to ask your vendor isn’t just «What version do I have?», but «Does my server already include the fix for CVE-2026-109618 and CVE-2026-109619?».

How to Update PHP to Fix Vulnerabilities

How you update depends on who manages the server. With most shared or managed hosting plans, the PHP security update is applied by the provider. For self-hosted servers, VPS, or cloud servers, the responsibility usually falls to your technical team.

1. Identify the current version: Note the branch and exact version of PHP for each site.
2. Confirm a recent backup: Make sure it includes files and the database, and that it can be restored. If you have any questions, check the difference between Web Backups and Storage.
3. Request or apply the update: Ask your provider for the fixed version of the same branch, or update the system packages if you manage the server.
4. Restart the PHP processes: The service must be restarted so that the fixed version can begin handling requests. Please confirm that this step has been completed.
5. Check the result: Check the Health section of the website again, or request written confirmation of the patch.
6. Try what generates revenue: contact forms, login, shopping cart, payments, search, image uploads, and main pages.

Upgrading within the same branch—for example, from 8.3.35 to 8.3.36—is usually a low-impact change in terms of compatibility, because it fixes bugs without changing how the language works. Jumping to a different branch—for example, from 8.1 to 8.4—does require more caution: ideally, you should test it first on a test or staging environment to detect incompatible plugins or themes.

What to Do If You Can't Update PHP Right Away

The official advisory includes temporary measures to mitigate certain attack vectors while the update is being scheduled. These measures are intended for server administrators, and the PHP team itself warns that They reduce exposure, but they do not make the installation safe.

• Disable tracking of upload progress during sessions (session.upload_progress.enabled=0) from the server's main configuration and restart all PHP processes.
• Reduce the maximum allowed size of shipments (post_max_size), especially on sites that don't need to receive files.
• Set limits on the web server or proxy the size of the requests, the number of fields, and the parts of the forms that include files.
• In PHP 8.5, disable error traces for fatal errors (fatal_error_backtraces=0) and restart the processes.
• Fix fatal errors and timeouts that a visitor might cause, for example, when importing or uploading files.

The notice also clarifies that hiding error messages does not help and that certain adjustments must be made in the server's main settings, not through configuration files in individual folders. Therefore, if you do not have technical access to the server, the practical solution is the same: Ask your supplier for the update and a written confirmation.

Checklist for Agencies That Manage Client Websites

A marketing or web development agency may have dozens of sites on different servers, hosting plans, and providers. When faced with a PHP vulnerability alert like this one, order matters more than rushing to a quick fix.

1. Take inventory: It lists each site, its hosting provider, the PHP version, and who has technical access to the server.
2. Sort by exposure: It primarily supports online stores, websites with forms, customer portals, reservation systems, and any website that receives files.
3. Open requests with each supplier: Request the corrected version and explicit confirmation of the patches for the two CVEs.
4. Check sites running on unsupported versions: PHP 8.1 or earlier versions require a migration plan, not just a patch.
5. Clearly communicate the following to your customers: Explain what happened, what was reviewed, what was updated, and whether there are any pending actions—without causing alarm or downplaying the situation.
6. Document the evidence: saves the date, previous version, new version, and test results for each site.
7. Watch for unusual signs: Unknown administrator accounts, unexplained recent files, redirects, or spikes in email traffic.

This type of alert also highlights the difference between having a hosting plan and having a maintenance service. If your customers aren't sure who is responsible for these tasks, the guide to Web Maintenance vs. Web Hosting It helps you explain it.

What Online Stores Should Check

An online store handles personal data, orders, and, in many cases, integrations with payment gateways. That’s why it’s one of the types of sites where PHP vulnerabilities on the server have the greatest impact. After updating PHP, test the entire checkout process without completing an actual payment, verify that order confirmation emails are sent, and ensure that the admin panel is functioning normally.

If your store uses WooCommerce, supplement this review with recommendations for Protecting an online store from attacks.

Common Mistakes When Dealing with These PHP Vulnerabilities

• To think that all you need to do is update WordPress and the plugins: The error is in PHP, not in WordPress.
• Assuming that a small site is not objective: Automated attacks scan the internet for vulnerable servers, regardless of the size of the business.
• Relying solely on temporary measures: The official notice states that they do not replace the update.
• Install PHP 8.6.0 RC4 in production: This is a trial version, and PHP advises against using it on live sites.
• Do not confirm the restart of the processes: An update that doesn't require a reboot may leave the previous version handling visits.
• Stay with PHP 8.1 or earlier: Those branches no longer receive official updates.

Official sources

The information in this article comes from the security advisory published by PHP, from the technical notices GHSA-w8hw-w9fx-j79w (CVE-2026-109618) y GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), and from the page at Supported PHP versions.

Frequently Asked Questions About PHP Vulnerabilities

Is my WordPress site affected?

This may be the case if the server is running a version of PHP that hasn't been patched. The vulnerability is in PHP, so it affects WordPress even if the core, plugins, and theme are up to date. Check the version under Tools > Site Health and confirm the patch with your provider.

Which version of PHP is secure against these vulnerabilities?

The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or later versions of those branches. A version packaged by your distribution or vendor may also be protected if they confirm that it includes the patch.

Does a security plugin protect me from these PHP vulnerabilities?

Not as a complete solution. According to the official advisory, in the highest-risk scenario, the attack can be triggered before the application code—including WordPress and its plugins—is executed. A firewall or a plugin can add layers of security to WordPress, but they do not replace updating PHP.

Could updating PHP break my site?

An update within the same branch carries a low risk of incompatibility. The risk increases when switching branches, for example, from 8.1 to 8.4. In that case, it’s a good idea to make a backup, test on a staging environment, and check the plugins and theme before applying the change to the live site.

What happens if my site uses PHP 8.1 or an earlier version?

Those branches no longer receive official updates from the PHP project. Some vendors offer their own patches, but it is recommended that you plan to migrate to a supported branch as soon as possible.

Conclusion: Updating PHP today is the right decision

The PHP vulnerabilities The vulnerabilities disclosed on October 21, 2026, are among the most serious a website can face: they allow code to be executed on the server without authentication and affect the engine that powers WordPress and millions of applications. The response does not call for panic, but rather a clear plan of action: check the version, verify that a backup exists, update to the patched version, restart PHP, and test key business functions.

If you manage your own website, start today by running a Site Health check and consulting with your provider. If you’re an agency, turn this alert into a repeatable process: assessment, prioritization, documentation, and clear communication with each client. That routine is what will make the difference the next time a critical alert appears.