A practical website guide

PHP security updates: what business owners need to know.

By Sam, Digital Weevil · Published 22 October 2026 · Updated 26 October 2026

Two critical PHP vulnerabilities prompted emergency updates on 21 October. Start by establishing what your website runs and asking your host whether the relevant fixes are installed.

What happened?

The PHP project disclosed CVE-2026-109618 and CVE-2026-109619. They concern memory handling and server state. In affected environments, an unauthenticated attacker may be able to run code on the server. The PHP announcement and NCSC guidance explain the issue and the need for action.

PHP is the software behind many dynamic websites, including WordPress. It runs at the hosting layer. You may never have installed it yourself, and your provider may already have patched it.

Does every PHP website face the same risk?

No. The running PHP version, patch history and server configuration matter. The PHP project identifies Apache mod_php as the highest-risk environment, with exploitation demonstrated before application code runs. Its announcement also describes PHP-FPM as susceptible based on source analysis, while distinguishing that from a demonstrated complete FPM exploit.

That distinction is a reason to check the actual environment, not to assume another configuration is safe. We cannot determine whether an individual website is exposed simply by looking at its public address. There is no claim here that your website has been attacked.

Which releases include the upstream fixes?

The PHP project lists these security releases for the supported branches:

These are the releases named for this incident, not a permanent list of the newest versions. Some operating-system and hosting vendors backport fixes into packages with different version numbers. Ask for the vendor’s advisory and package evidence for both CVEs. An older branch may need vendor-supported maintenance or a planned migration.

If you run WordPress

Updating WordPress, themes and plugins remains part of routine maintenance, but it does not necessarily update the underlying PHP runtime. WordPress Site Health may show a PHP version; your hosting panel or support team can help confirm what serves the live site and whether a vendor backport applies.

A newer command-line PHP installation is not proof that the web server uses it. Avoid putting a public diagnostic page online to reveal server details. Ask your provider for the relevant information privately.

Five useful steps today

1. Identify the host. Check the provider’s dashboard or a hosting invoice. A domain registrar may be a different company from the website host.
2. Ask about both CVEs. Request confirmation that the PHP runtime serving your website has the fixes, including any vendor backport. Keep the reply and date.
3. Agree the update route. Use your provider’s supported fix. Before changing versions, confirm compatibility, backups, a recovery route and an appropriate test window.
4. Check the result. Confirm the running environment and test the important parts of the site, such as pages, forms and admin access.
5. Escalate suspicious activity. Unexpected admin accounts, redirects or changes warrant prompt host and specialist advice. A patch alone does not remove an existing compromise.

What about static and managed websites?

A static site without a PHP runtime is not affected by these PHP runtime vulnerabilities. It may still use other services with their own update needs. Managed hosting can reduce the work you need to do, but check your provider’s announcement and confirmation for your own site rather than assume a general message covers every environment.

When to get help

Start with your host if an update is urgent. Seek specialist incident response if you suspect compromise. Custom servers, unsupported applications, shops and sensitive data need a carefully agreed plan; a cheap routine-update package is not a substitute for that work.

If you need help understanding the evidence and your next step, Digital Weevil offers a £49 PHP Security Check, with conditional update assistance for suitable straightforward sites. You can use the questions above without buying anything.

Official sources

• PHP project: 21 October security announcement
• NCSC: critical security issue affecting PHP
• PHP advisory: CVE-2026-109618
• PHP advisory: CVE-2026-109619

This article explains the named advisories; it does not assess your website or certify its security. Digital Weevil is independent and is not an official partner of PHP or the NCSC. Guidance can change: check the current official advisories with your provider before making changes.