Update: October 28, 2026
PHP published two further notices after this article. The October 23 notice concerns an uncommon session configuration that changes serialization handlers at runtime. On October 26, revised Windows builds updated the bundled Brotli library. That Windows rebuild does not change the reported PHP version number.
Ask your hosting provider whether either notice applies to your environment and which patched build it supplies. The October 21 fixes discussed below remain relevant. See PHP’s dated release notices and advisories for the details.
Updated October 21, 2026.
The National Security Agency has warned organizations about two critical PHP security vulnerabilities. PHP released fixes on October 21, 2026, and the NSA has updated its advisory to call for immediate patching. Read the updated NSA advisory.
If your business website runs on WordPress or another PHP application, contact your hosting provider today. Ask whether the PHP software serving your site has both fixes. A working homepage and an updated WordPress dashboard do not answer that question.
What the two PHP vulnerabilities allow
PHP runs on a web server and handles tasks such as building pages, processing forms, and working with databases. A flaw in that software can affect a website even when its owner keeps WordPress, themes, and plugins current.
The two flaws have these Common Vulnerabilities and Exposures identifiers, usually shortened to CVE:
- CVE-2026-109618: PHP can mishandle memory when it runs out of available memory during request processing. Later cleanup can treat invalid data as valid.
- CVE-2026-109619: PHP can retain internal information after it has released the memory that information belongs to. A later request can access that stale state.
Both carry a critical score of 9.2 out of 10 under the Common Vulnerability Scoring System, version 4. They can allow remote code execution without a login. In plain language, an attacker may run code on the affected server without first obtaining a website account. The first PHP advisory and second PHP advisory explain the technical conditions.
The resulting access depends on the permissions of the web server process. It does not automatically give an attacker control of every system. It can still expose files, credentials, or data that the website can access.
PHP considers installations that serve web requests at risk across several server configurations. Some demonstrated attacks reach vulnerable PHP code before the website’s application code runs. A security plugin cannot replace the PHP update. See PHP’s security announcement.
The PHP versions that contain the fixes
PHP lists these as the first fixed releases in its supported production branches:
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Install the fixed release for your supported branch, or a later supported stable release that includes these fixes. Your host should confirm the correct package for its servers.
Some vendors apply a security fix to an older software package and retain its original version label. This is a backported fix. For example, Ubuntu lists a fixed PHP 8.3 package as 8.3.6-0ubuntu0.24.04.13. That is why a version number in WordPress alone cannot settle the question. Ask for confirmation that the installed package fixes both CVEs. See Ubuntu’s package notice.
PHP 8.1 and older have reached the end of normal PHP-project support. Emergency backports and vendor-supported packages exist for some older branches, but they do not restore normal upstream support. If your site depends on an old branch, arrange a supported upgrade.
PHP 8.2 still receives security fixes through December 31, 2026. Patch it now, then schedule the next version change before support ends. Check PHP’s support schedule.
What to do if your website runs on WordPress
1. Check the PHP version that serves your site. In WordPress, open Tools → Site Health → Info → Server. Record the complete PHP version. Also identify your hosting plan, since managed WordPress hosting and a server you administer can have different update responsibilities. WordPress documents the Site Health screen here.
2. Ask your host about the two specific fixes. Send this message through your hosting account’s support system:
Please confirm whether the PHP runtime serving my domain has the fixes for CVE-2026-109618 and CVE-2026-109619. What full PHP package or build is active? If you applied a backported fix, please confirm that it covers both vulnerabilities. Have all affected PHP processes loaded the patched version? If patching is still pending, what temporary protection is in place and when will the update finish?
Save the reply with your website maintenance records. A response that says only “your website is up to date” needs a follow-up about PHP.
3. Coordinate a backup and the update. Have a recent backup of both the website files and database. Ask your host or developer to install the security fix promptly. WordPress places PHP configuration at the hosting level, so a WordPress core, theme, or plugin update is a separate task. WordPress explains that distinction in its Site Health guidance.
Changing from one PHP branch to another can affect compatibility. When your current supported branch has a fixed release, ask whether your host can apply that patch first. For a larger version change, test a staging copy promptly. Avoid leaving a vulnerable public site exposed while an open-ended testing project continues.
4. Test the parts of the site that bring in business. After the host confirms the update, follow a short checklist:
- Submit your contact form and confirm that the message arrives.
- Check account login and password reset.
- Test checkout, booking, or payment features that your site offers.
- Ask your developer to check for new PHP errors.
These checks help find compatibility problems. They do not prove that the server is free of malware.
5. Include the sites you rarely open. Ask the host to check staging sites, old subdomains, customer portals, and other PHP applications in the account. The UK National Cyber Security Centre recommends an inventory of PHP systems, with public-facing services first. Read its response guidance.
GoDaddy customers need to check their hosting plan
GoDaddy’s update at 19:30 UTC on October 21, 2026 reported different conditions across its products:
- Managed Hosting for WordPress: GoDaddy said it had patched all PHP versions on this product.
- Web Hosting and Windows Hosting: GoDaddy said temporary protections were in place while it waited for patched vendor packages.
- Virtual private servers: The server administrator needs to apply the update.
Check GoDaddy’s current PHP notice and confirm the status of your hosting account. Selecting “PHP 8.3” in a control panel does not establish which security patch is active.
If your host cannot apply the update immediately
PHP has published temporary measures that reduce particular attack paths. Its security team says those measures do not provide a complete fix. Have the server administrator assess them against the application and hosting setup. Treat them as temporary protection while patching proceeds.
The NSA recommends taking the system offline if an immediate update is not feasible, until it can be fully mitigated. If you face that situation, ask your host to prevent public requests from reaching the affected PHP service.
A WordPress maintenance page does not establish that protection. WordPress’s own maintenance response executes PHP. From that behavior, a maintenance message alone cannot be treated as isolation from a PHP flaw. Your host needs to block access before the affected PHP code runs. See WordPress’s maintenance function.
Ask whether the host can display a simple static notice with your phone number or email address while the affected application is isolated. Do not restore an exposed PHP build just to make a broken plugin work.
If you suspect someone has accessed your site
Installing the update fixes the vulnerable software. It does not remove a backdoor, reverse data theft, or prove that nobody accessed the system before the patch.
If you find unfamiliar administrator accounts, unexpected files, changed payment details, or unexplained redirects, contact your host’s security team. Ask it to preserve relevant logs and investigate the affected environment. These symptoms warrant a review, but none identifies these PHP flaws as the cause by itself.
The National Cyber Security Centre advises checking for evidence of compromise when systems cannot be updated or disabled immediately. Get incident-response help if you cannot assess the server. Coordinate credential changes with the investigation so newly issued credentials do not remain exposed on a compromised system.
Make PHP updates part of your website maintenance
Assign someone to receive hosting security notices and confirm that updates reach the live site. Keep the host’s patch confirmation, a current backup, and a record of the features tested after each change.
If you need help planning a supported website setup, explore our website design services or contact Innovative Marketing Solutions. Send your website address, hosting plan, and the answer your host provided about these PHP fixes. That gives us a concrete place to start.
