.webp)
Two serious PHP security vulnerabilities have been discovered, potentially putting millions of websites at risk. If your business uses WordPress or another PHP-based platform, here’s what you need to know and what you should do next.
On 21 October 2026, the PHP development team released urgent security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities could allow attackers to execute malicious code on affected web servers without needing to log in.
For businesses running WordPress websites, online stores or custom PHP applications, this is an important security update that shouldn’t be ignored.
The good news? Security patches are already available.
What exactly happened?
PHP is the programming language running behind many websites, including WordPress.
Think of it as the engine that makes your website work. While customers interact with the design, content and functionality, PHP handles much of what happens behind the scenes.
Security researchers identified two vulnerabilities affecting PHP’s internal handling of website requests.
These vulnerabilities, also referred to as PHP2Shell, can potentially allow attackers to run unauthorised code on vulnerable servers.
In practical terms, a successful attack could allow someone to access sensitive information, interfere with website functionality or compromise the server hosting your website.
Importantly, the vulnerabilities exist within PHP itself, not within WordPress or a particular plugin.
This means that even websites running the latest WordPress version and updated plugins may still be exposed if their underlying PHP installation hasn’t been patched.
Is your WordPress website affected?
Potentially, yes.
The vulnerabilities affect several PHP versions commonly used by WordPress websites and other PHP-based applications.
The PHP development team has released the following security updates:
| PHP version | Security update required |
|---|---|
| PHP 8.2 | Update to 8.2.35 or later |
| PHP 8.3 | Update to 8.3.36 or later |
| PHP 8.4 | Update to 8.4.27 or later |
| PHP 8.5 | Update to 8.5.12 or later |
PHP 8.1 and older versions no longer receive standard security releases from the PHP project. Some hosting providers and operating-system vendors offer separately maintained security patches, but upgrading to a supported version is strongly recommended.
Please note: Not every affected website has been compromised, and the precise level of exposure depends on the server configuration. However, all affected PHP installations serving web requests should be treated as requiring urgent attention.
How to check which PHP version your website is running
If your business uses WordPress, checking your PHP version is relatively straightforward.
- Log in to your WordPress dashboard.
- Navigate to Tools → Site Health.
- Select the Info tab.
- Expand the Server section.
- Look for the PHP version listed.
Compare this number against the patched versions above.
If your website is running an older version, contact your website developer or hosting provider to confirm whether the security patch has been applied.
Be aware that some hosting providers apply security fixes without changing the displayed PHP version number. Your hosting provider can confirm whether your particular installation is protected.
How to protect your website
If your website could be affected, there are several steps worth taking immediately.
1. Update PHP to a patched version
This is the most important step.
PHP has confirmed that updating the affected installation is the only complete solution to these vulnerabilities.
Depending on your hosting provider, you may be able to update PHP through your hosting control panel, or the update may need to be performed by your hosting company.
Before making changes, ensure your website has a recent backup and that its themes, plugins and custom functionality are compatible with the selected PHP version.
2. Check your hosting environment
Your hosting provider plays an important role in keeping your website secure.
Ask whether the PHP installation serving your website has received the latest security patches.
If your website runs on shared hosting, a VPS or a dedicated server, the update process may differ.
It’s important to confirm that the live website is actually running the patched version, rather than simply assuming an update has been applied.
3. Review your website’s security
While updating PHP addresses these specific vulnerabilities, general website security remains important.
Keep your WordPress installation, themes and plugins updated. Remove software you no longer use and ensure administrative accounts are protected with strong passwords and multi-factor authentication.
It’s also worth reviewing website and server logs for unusual activity, particularly if your website was previously running an affected PHP version.
4. Consider additional protection with Cloudflare
Services such as Cloudflare can provide an additional layer of website security.
A properly configured Web Application Firewall (WAF) can help identify and block certain malicious requests before they reach your website.
However, Cloudflare is not a replacement for updating PHP.
A firewall can reduce exposure to known attack patterns, but it cannot guarantee protection against every possible method of exploiting these vulnerabilities.
The PHP security patch remains essential.
5. Test your website after updating
Security updates are important, but they should also be handled carefully.
After updating PHP, test your website’s key functionality, including:
- Contact forms and enquiry submissions
- Login and account functionality
- Online payments and checkout processes
- Integrations with third-party platforms
- Custom functionality and administrative features
An update that resolves a security issue but breaks an important business function still requires attention.
What happens if you don’t update?
Leaving an affected PHP installation unpatched can expose your business to unnecessary risk.
Depending on the nature of an attack, potential consequences include website downtime, unauthorised access to data, malicious changes to website files and disruption to business operations.
For e-commerce websites and businesses that rely on their websites for daily enquiries, these issues can have a direct commercial impact.
Security isn’t simply a technical concern. It’s part of protecting your business, your customers and the digital systems you depend on.
Does updating WordPress fix the PHP vulnerability?
No.
Updating WordPress, your themes and plugins is important, but these particular vulnerabilities affect the underlying PHP installation on your server.
Your website can be running the latest WordPress version while still using an affected PHP release.
The PHP security update needs to be applied at server level.
What if my hosting provider manages PHP updates?
If you’re using managed hosting, your provider may already have applied the necessary security patches.
However, it’s worth requesting confirmation.
Ask your hosting provider whether the PHP version serving your website has been patched against CVE-2026-109618 and CVE-2026-109619.
If they use vendor-maintained security backports, ask them to confirm that both vulnerabilities have been addressed.
Website security shouldn’t be an afterthought
This incident is a reminder that maintaining a website involves more than publishing content and occasionally updating plugins.
Hosting environments, server software, security configurations and ongoing maintenance all play a role in keeping a website reliable.
At Digital Fold, we work with businesses to build, maintain and improve websites, including WordPress websites and custom web applications.
From ongoing website maintenance to technical troubleshooting and hosting coordination, our team helps businesses keep their websites secure and functioning as intended.
