Last checked: October 22, 2026
On October 21, 2026, the people who maintain PHP released an urgent fix for two serious security flaws. PHP is the software that runs behind most WordPress websites, so if your business has a WordPress site, this probably applies to you. The good news: checking whether you’re covered takes a few minutes, and in most cases your web host does the actual fix.
What happened
PHP is the programming language that runs on your web host’s server and builds your web pages each time someone visits. On October 21, the PHP project announced two flaws, named CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity (critical).
In plain terms, both flaws can let an attacker run their own code on a web server without logging in. An attacker who can do that could change your site, add spam or malware, or get at data stored on the server.
The US Cybersecurity and Infrastructure Security Agency (CISA) told organizations to patch right away. As of its October 21 alert, CISA said it had not seen attacks using these flaws yet. The European Union’s cybersecurity team (CERT-EU) noted that sample attack code had started circulating, which makes attacks more likely.
The PHP Foundation said the main flaw was confirmed by several security firms, some of which used AI-based tools to test PHP. In Japan, the government said parts of some ministry websites, including the Finance Ministry, were taken offline as a precaution while patching was underway, and that no damage had been reported (as reported by Kyodo News).
Who is affected
According to PHP’s own advisory, every PHP setup that serves web pages is at risk until it’s updated. That includes the common setups hosts use (Apache, LiteSpeed, PHP-FPM and others).
- WordPress sites: WordPress itself isn’t the problem. WordPress.org says no WordPress update is needed. The fix has to happen to PHP on your server.
- Other website builders that run on PHP (for example, many shopping carts, forums and booking tools you host yourself) are affected the same way.
- Hosted builders like Wix, Squarespace or Shopify: you don’t manage PHP on these, so there’s nothing for you to update. If you’re unsure, ask their support.
The fixed versions
Your site is covered once it runs one of these PHP versions or newer:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and anything older no longer gets updates from the PHP project. If your site runs one of those, it needs to move to a newer version (some hosts offer their own patched builds, so ask yours). Note that PHP 8.2 stops getting security fixes after December 31, 2026, so if you’re on 8.2, plan a move to 8.3 or newer.
How to check your PHP version (no technical skills needed)
Option 1: Inside WordPress
- Log in to your WordPress dashboard.
- Go to Tools > Site Health.
- Click the Info tab, then open the Server section.
- Look for PHP version. Compare it with the list above.
Option 2: In your hosting control panel
Most hosts show the PHP version in their control panel. In cPanel, look for Select PHP Version or MultiPHP Manager. Other hosts list it under the site’s settings. If you can’t find it, ask your host’s support chat.
One catch: the version number has to be exact. “8.4” isn’t enough. 8.4.26 is still exposed, and 8.4.27 is fixed.
What to ask your web host
You can copy and paste this into a support ticket or chat:
Hi, I’m checking on the PHP security fixes released October 21, 2026 (CVE-2026-109618 and CVE-2026-109619). Can you confirm:
- Which exact PHP version is running my site right now?
- Has it been updated to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer), and were PHP processes restarted after the update?
- If my site is on PHP 8.1 or older, what’s the plan to move it or patch it?
- Is there anything I need to do on my end?
Asking about the restart matters. Installing the update doesn’t protect the site until the running PHP processes are restarted.
Steps to take this week
- Check your PHP version using one of the options above.
- If it’s not on a fixed version, contact your host with the message above. On most shared hosting, only the host can update PHP.
- If your host lets you pick the PHP version and a fixed one is listed, you can switch to it yourself. Back up your site first, then load a few pages to make sure everything still works.
- Make a fresh backup of your site and keep a copy somewhere other than your hosting account.
- Watch for warning signs: pages you didn’t create, strange redirects, new admin users, or a warning from Google in Search Console. If you see any of these, contact your host right away.
- Keep WordPress, plugins and themes updated as usual. That won’t fix this PHP flaw, but it closes other doors attackers use.
Should you take your site offline?
For most small businesses on a managed or shared host, no. Contact your host first. CISA’s advice to take systems offline applies to organizations that can’t update or are stuck on PHP 8.1 or older. If your host says your site is on an old PHP version and can’t be updated soon, ask them about moving it or putting it behind a web firewall in the meantime.
What if your site does get hacked?
Cleanup usually means paying a security service or developer, possible downtime and lost sales, and, if customer information was exposed, following your state’s data breach notice rules. Cyber insurance can help cover some of these costs. Simply Business lets you compare cyber liability quotes from several insurers online.
Frequently asked questions
Is WordPress itself broken?
No. The flaws are in PHP, the software WordPress runs on. WordPress.org says no WordPress update is needed. You need your server’s PHP updated.
Will updating WordPress or my plugins fix it?
No. Only updating PHP on the server fixes these two flaws.
How do I know which PHP version I have?
In WordPress, go to Tools > Site Health > Info > Server and look for “PHP version.” You can also find it in your hosting control panel or ask your host.
Which versions are safe?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer versions in those lines. PHP 8.1 and older don’t get official fixes.
Has anyone been attacked yet?
As of October 21, CISA said it had not seen attacks using these flaws. CERT-EU said sample attack code was circulating, so attacks are more likely now. Don’t wait.
Does my site use PHP if I’m on Wix, Squarespace or Shopify?
Those platforms manage their own servers, so you don’t have a PHP version to update.
Does a firewall or security plugin protect me?
CISA says a web application firewall may give some protection until you update, but it isn’t a replacement for the update.
Sources
- PHP.net security advisory, Oct. 21, 2026: https://www.php.net/
- CISA alert, Oct. 21, 2026: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- CERT-EU advisory 2026-018: https://www.cert.europa.eu/publications/security-advisories/2026-018/
- WordPress.org: https://wordpress.org/news/2026/10/critical-php-security-release/
- PHP Foundation: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- Kyodo News, Oct. 22, 2026: https://english.kyodonews.net/articles/-/89026