The PHP development team announced two critical security flaws that expose servers to remote code execution.
Because WordPress, Joomla and Drupal rely entirely on PHP to execute their server code, this is a security vulnerability every website owner needs to address immediately.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry an alarming CVSS severity score of 9.2 out of 10.
Cyber security authorities warn that nearly all versions from PHP 5.4 onwards may be susceptible.
If your business depends on a WordPress, WooCommerce, Drupal, Joomla or any other PHP website, you need to address this immediately.
What is this PHP Security Vulnerability?
The two vulnerabilities currently making headlines (CVE-2026-109618 and CVE-2026-109619) involve remote code execution within the core PHP engine.
When an attacker exploits a remote code execution vulnerability, they gain the ability to run arbitrary commands on your website’s server.
This level of access bypasses typical application firewalls and threatens databases, customer information and stored files.
Security researchers first noted discussions about these flaws on the 20th of October 2026, accompanied by reports of a leaked exploit script dubbed PHP2Shell.
The exploit reportedly targets fundamental memory or request parsing handling in PHP, potentially impacting every release from PHP 5.4 onwards.
Official announcements from the Australian Cyber Security Centre quickly followed urging web administrators to prepare for urgent patching.
Shortly after, Cloudflare detected initial attack probes and rolled out early protective rules to shield web traffic across its proxy network.
While security teams have mobilised quickly, the official upstream fix from the PHP security team is expected to release at 12:00 am AEST / 1:00 am AEDT tonight (22nd of October, 2026).
Next Steps for Website Owners & Managers
Securing your website requires immediate coordination with your hosting provider.
You do not need to rewrite your website codebase, but you must confirm that your hosting provider is actively applying the latest PHP security updates when they release.
Inaction can leave your business open to severe automated exploitation within 15 minutes of the official release according to Sansec.
Start by auditing where your websites are currently hosted and if they’re using PHP 8.1 or older.
If you’re utilising managed hosting, your provider may already be deploying upstream patches behind the scenes.
Taking a full offsite backup of your website files and database before any server modifications is standard best practice.
This simple precaution guarantees a reliable restore point should any plugin compatibility hiccups arise following the runtime upgrade on your production system.
Check Your Current PHP Version
Before reaching out to your hosting team, you should identify the exact PHP version your website currently runs.
While these two security vulnerabilities are expected to affect all versions from PHP 5.4 onwards, the PHP development team is releasing a security patch for PHP 8.2 and later so you want to make sure you’re up-to-date.
Fortunately, WordPress makes checking your PHP version straightforward from your administrator dashboard without requiring server logins or complex terminal commands.
Begin by logging into your WordPress admin portal. From the left sidebar, navigate to Tools and select Site Health.
Once you arrive at the Site Health screen, click on the Info tab and expand the Server dropdown menu to reveal technical server specifications.
Inside this menu, you will see a field labelled PHP Version.
Take note of this version number and if it’s older than PHP 8.2, immediately contact your hosting provider and website developer.
Coordinate with Your Hosting Provider
Once you know your active PHP version, submit a priority ticket to your web hosting provider.
Ask their technical team whether your server has received the patches for CVE-2026-109618 and CVE-2026-109619.
Some proactive hosts have already deployed fixes ahead of the public release. For instance, SiteGround confirmed they patched PHP 8.2 through 8.5 across their entire platform, eliminating immediate risk for their hosted clients.
The latest patched PHP version numbers that will address these two security vulnerabilities are:
- PHP 8.2: 8.2.35
- PHP 8.3: 8.3.36
- PHP 8.4: 8.4.27
- PHP 8.5: 8.5.12
Should your site still operate on legacy versions like PHP 7.4 or 8.1, you face an additional hurdle.
These versions reached end-of-life status and will not receive upstream patches, meaning an upgrade to PHP 8.2 or newer is imperative to protect your web presence against persistent automated exploits.
Upgrade from Legacy PHP (Without Crashing Your Site)
If your website runs on an end-of-life release like PHP 7.4, 8.0 or 8.1 then an upgrade to PHP 8.2 or newer is mandatory to resolve these vulnerabilities.
However, updating your server’s PHP version on a live production site is risky (especially moving from PHP 7.4 to 8.2 or newer).
These updates introduce new strict rules and remove outdated functions that often break older WordPress sites.
If older plugins, themes or custom code rely on a discontinued PHP version, an untested upgrade can trigger fatal errors and take down your entire website with a “Critical Error” screen.
To upgrade safely without risking downtime, follow this four-step process:
- Update WordPress Core, Theme & Plugins First: Before changing your PHP, update WordPress core, your active theme and every installed plugin to their latest versions while still running your existing PHP environment.
- Test on a Staging Site: Never perform a major PHP upgrade on your live site. Use a staging environment to test PHP 8.2 or 8.3 by turning on WordPress debug logging and testing critical user workflows (contact forms, checkout fields, admin dashboards, etc).
- Check for Hardened Older PHP Versions: If an old plugin or custom legacy code breaks under PHP 8.2 and cannot be rebuilt overnight, consult your hosting provider. Many hosts independently backport security fixes to end-of-life releases like PHP 7.4 and 8.1 outside the official release. This buys valuable development time while maintaining security.
- Lock Down Unpatchable Systems: If your site cannot safely run PHP 8.2+ today and your host offers no extended security patching, treat the server as actively exposed. Place the entire administrative backend behind HTTP Basic Authentication, enforce strict Cloudflare WAF managed rules or temporarily restrict public access to trusted IP addresses until the code can be updated.
Implement Temporary Server Mitigation Techniques
If your hosting provider cannot apply patches immediately, several server configurations can reduce exposure while you wait.
These temporary mitigations help block exploit attempts before malicious data reaches the vulnerable PHP parser.
Applying temporary restrictions protects customer data and sensitive business information during the patching window.
One effective strategy involves blocking multipart form data requests at your web server level, such as Nginx or Apache.
Attackers often leverage file upload mechanisms to pass malicious request bodies into the PHP parser. Rejecting these requests at the web server boundary stops the exploit before execution.
Blocking these requests prevents the exploit from triggering, although it will temporarily disable legitimate file uploads such as WordPress media library additions.
You should place a test order or submit an enquiry form to verify functionality, then remove this server rule as soon as your host applies the patch.
Additionally, server administrators can adjust php.ini directives to disable session upload progress and enforce strict session mode across all active pools.
While not a complete replacement for the official patch, these steps introduce meaningful barriers against automated scanning tools attempting to exploit vulnerable servers.
How to Protect Your Website Moving Forward
Emergencies like this highlight the vital importance of proactive website infrastructure management.
Websites are dynamic business assets that require steady attention, scheduled updates and continuous monitoring to stay resilient against emerging online threats.
Taking an active role in website care protects brand reputation.
Partnering with experts like White Peak Digital for routine website maintenance removes the stress of sudden vulnerabilities like this.
A structured maintenance routine ensures core software, database tables and server dependencies remain modern, stable and backed up against unexpected system disruptions.
Selecting the right web hosting environment also makes a substantial difference.
Quality managed hosts constantly monitor threat intelligence feeds, implement proactive server firewalls and deploy critical security updates before vulnerabilities become public knowledge.
Frequently Asked Questions
What are the two latest critical PHP security vulnerabilities?
They are two severe security flaws tracked as CVE-2026-109618 and CVE-2026-109619. They carry a 9.2 CVSS rating out of 10 and allow attackers to execute unauthorised code on web servers running vulnerable PHP versions.
Does this security flaw impact WordPress sites?
Yes. WordPress relies on PHP to execute server code. If your web host runs an unpatched version of PHP, your entire site and database could be vulnerable regardless of your WordPress core version.
Can a WordPress security plugin fix this PHP issue?
No. WordPress security plugins operate at the application layer. While they can filter certain malicious requests, they cannot patch the underlying PHP runtime installed on your server operating system.
How do I check my PHP version on WordPress?
Log in to your WordPress dashboard, navigate to Tools, select Site Health and click the Info tab. Expand the Server section to view your current PHP version number.
Are older PHP versions receiving a security update?
No. PHP 7.4, 8.0 and 8.1 are officially end-of-life upstream. They do not receive official security updates, which makes upgrading to a supported version like PHP 8.2 or 8.3 crucial for website safety.
