On 21 October 2026, the team behind PHP released emergency updates for two critical PHP vulnerabilities. Within hours, government, hospital and university websites across Europe were taken offline as a precaution. If your website runs on WordPress, it runs on PHP, so this affects you too. Here is what happened, in plain English, and what to do about it.
What happened?
On 20 October, details of two serious PHP vulnerabilities leaked before their planned disclosure. The PHP security team warned administrators to prepare, and on 21 October it published fixes for every supported version. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 (critical).
The response was unusually strong. The EU’s cyber emergency team (CERT-EU) advised organisations that could not patch in time to take affected sites offline. The US National Security Agency and the FBI gave similar advice, and cyber agencies in the UK, Canada, Australia and Japan urged everyone to update immediately. In Germany, France, Belgium, the Netherlands, Finland and the Czech Republic, public bodies pulled websites offline while they patched. Most of these shutdowns were precautionary: a site going offline does not mean it was hacked.
Why this matters for small organisations
PHP is the language that quietly builds most web pages behind the scenes. It runs roughly seven in ten websites whose server language can be identified, including every WordPress, Drupal, Joomla and Magento site.
Three things make these flaws especially serious:
- No login needed. An attacker can send a specially crafted request to a vulnerable server and run their own code on it, without a username or password.
- Your plugins can’t fix it. The problem is in PHP itself, not in WordPress or your theme. Updating plugins, or relying on WordPress automatic updates, leaves the flaw in place.
- Many owners don’t control PHP. Small businesses, charities and CICs are often on shared hosting, where the hosting company manages PHP. Many site owners don’t know which version they run or who updates it.
The two PHP vulnerabilities, in plain English
CVE-2026-109618 (out-of-memory corruption). When PHP runs out of memory part-way through handling a request, it can stop before its internal data is fully set up. The clean-up that follows may then treat that half-built data as valid. An attacker who triggers this deliberately can corrupt memory and take control of the server process.
CVE-2026-109619 (stale state). Information belonging to one web request can survive after the memory behind it has been freed. A later request handled by the same PHP worker may then use that leftover information, which an attacker can exploit to run code.
PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for Apache with mod_php.
Am I affected by the PHP vulnerabilities?
| Your PHP version | Fixed in | What to do |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update now |
| PHP 8.4 | 8.4.27 | Update now |
| PHP 8.3 | 8.3.36 | Update now |
| PHP 8.2 | 8.2.35 | Update now, and plan a move to 8.3 or later: 8.2 stops receiving security fixes on 31 December 2026 |
| PHP 8.1 or older | No official release | Ask your host or Linux vendor for a backported fix, or upgrade to a supported version |
One catch: if your server installs PHP from a Linux distribution’s packages, the fixed package may keep the old version number. Check the package changelog or ask your host, rather than relying on the number alone.
What to do now: a checklist
- Find your PHP version. In WordPress, go to Tools → Site Health → Info → Server. On a server you manage, run
php -v. - Ask your hosting company. If you’re on shared or managed hosting, contact support and ask directly: “Have you applied the fixes for CVE-2026-109618 and CVE-2026-109619 to my account?” Get the answer in writing.
- Update and restart. If you manage the server, install the fixed version, then restart PHP-FPM or the web server so the new code is actually loaded. Check the version again afterwards.
- Don’t forget hidden PHP. Control panels such as cPanel and Plesk, staging sites, old microsites and some appliances all run PHP too. Check them all, starting with anything public-facing.
- Look for signs of trouble. Review your server logs from 20 October onwards. Watch for admin users you don’t recognise, new or changed files you didn’t make, and unexpected processes started by PHP.
- Make sure you have a recent backup stored somewhere other than the server itself.
If you can’t update today
PHP is clear that only an update fully fixes these flaws. Its advisory lists temporary measures for administrators who need time, for example turning off session.upload_progress.enabled and lowering post_max_size, but these only reduce exposure to specific attack paths. If a site cannot be patched or protected quickly, the official advice is to take it offline until it can be.
The AI angle: a race between attackers and defenders
According to Reuters, researchers at Calif, working with OpenAI, reported the first flaw to PHP in August, and researchers at Wiz reported the second shortly after. Both teams used AI models to find them. That is good news for defenders, but the same tools can help attackers compare old and new PHP code to work out exactly what was fixed, then scan the internet for servers that haven’t updated.
The big AI companies are responding. In September, OpenAI committed $1 billion in subsidised access to its cyber-defence tools, along with training and technical support, aimed at organisations that protect essential services and don’t have big security budgets. It’s a reminder that smaller organisations are now on the front line too, and that the window between a fix being published and attacks starting is getting shorter.
How AspireHer Digital Studio can help
We don’t just build websites. Our team follows security news like this closely, so the organisations we work with aren’t left guessing when something serious breaks. If you’re not sure whether your website or server is affected, we can check which PHP version you’re running, talk to your hosting company for you, apply updates safely, and look for signs that anything has been tampered with.
For ongoing peace of mind, our website care plans start at £35 a month and include updates, daily backups, and security and uptime monitoring, so you have someone on your side the next time a flaw like this appears.
Sources: PHP security advisory (21 Oct 2026) · NCSC: Critical security issue affecting PHP · Canadian Centre for Cyber Security alert AL26-026 · Reuters reporting on website shutdowns and the OpenAI commitment. This article is general guidance, not a substitute for advice on your specific setup.
