Two critical vulnerabilities discovered in PHP have triggered an international security alert affecting websites, online shops and applications hosted on servers worldwide. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to execute malicious code remotely without authentication.
On 21 October 2026, the PHP maintainers released emergency updates to address both issues. If you have a website built with WordPress or another system that uses PHP, you should check which version is installed and whether your hosting provider has applied the fixes.
What has happened with PHP and why it is so serious
PHP is one of the most widely used programming languages for building dynamic websites. It powers systems such as WordPress, Joomla and Drupal, as well as many custom-built applications.
Unlike HTML or CSS, PHP runs on the server hosting the website. Among other tasks, it can process forms, access databases and generate content before sending it to a visitor’s browser.
The two vulnerabilities affect PHP’s internal operations. According to the official security advisory, an attacker could exploit certain flaws in request processing to execute unauthorised instructions on a vulnerable server.
The severity of the flaws has prompted European bodies to recommend immediate updates. Some public authorities and organisations have even temporarily taken their services offline as a precaution.
This does not mean that every website built with PHP has been attacked, but vulnerable installations should be reviewed as soon as possible.
How to find out whether your website uses PHP
The first step is to identify the technology your website is built with.
If you use WordPress, Joomla, Drupal or an application developed in PHP, your website relies on this language. However, that does not automatically mean it is unprotected: the installed version and the security updates applied on the server also matter.
If you do not know which technology your website uses, check your hosting documentation or ask the company that developed it.
There are also online tools that attempt to identify a website’s technologies, although their results are not always conclusive. In addition, you cannot reliably confirm whether a server has these vulnerabilities simply by visiting its website.
How to check the PHP version in WordPress
If you have access to the WordPress admin dashboard, you can check the PHP version without installing any additional plugins.
Follow these steps:
- Log in to the WordPress admin dashboard, usually at
tudominio.com/wp-admin. - In the sidebar menu, go to Tools.
- Select Site Health.
- Open the Info tab.
- Expand the Server section.
- Find the PHP version field.
This section will show a number such as 8.3.35 or 8.4.26. Make a note of it so you can compare it with the patched versions.
If you cannot find this information, you can also check your hosting provider’s control panel, which may use tools such as cPanel, Plesk or another management system.
Bear in mind that WordPress shows the version used by your website, but does not necessarily indicate whether your provider has applied additional security fixes.
Which PHP versions are affected
On 21 October 2026, the PHP development team released the following patched versions:
| PHP version | Minimum patched version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
For example, an installation running PHP 8.3.35 predates the official security update. For that release branch, the patched version is PHP 8.3.36.
PHP 8.1 and earlier versions no longer receive regular updates from the PHP project. However, some operating system vendors and extended support providers release their own fixes for older versions.
That is why, if you use a version earlier than those listed, you should not assume it is either protected or necessarily vulnerable without checking your provider’s patches.
You can check the published releases on the official PHP website.
What to do if your website uses a vulnerable version
If you discover that your website runs a PHP version older than the patched release and you have no confirmation that a patch has been applied, it is important to act quickly.
1. Contact your hosting provider. Ask whether your server is affected by vulnerabilities CVE-2026-109618 and CVE-2026-109619 and whether the relevant updates have already been installed.
2. Create a backup. Before making changes to the environment, make sure you have a recent backup of your files and database. It is advisable to check that it can be restored.
3. Update PHP to a patched version. If you manage the server, you will need to install the relevant security packages. If you use shared hosting, your provider may handle this or let you select the version from its control panel.
4. Check that the website works properly. Review its main sections, forms and user logins, and, if you run an online shop, the checkout process.
5. Request a technical review if you suspect an attack. Installing an update prevents exploitation of the patched flaws, but does not automatically remove any malicious changes made beforehand.
Could updating PHP break my website?
Yes. Although keeping PHP up to date is essential for security, moving from an older version to a newer one can cause compatibility issues.
This is particularly common on websites that use themes, plugins or custom code that have not been updated for some time.
For example, changing the PHP version could cause errors in contact forms, online shop features or components that rely on older code. In more serious cases, the website could stop loading correctly.
Where possible, it is therefore advisable to try the change in a test environment first and check the compatibility of the installed components.
However, these risks do not justify leaving a server vulnerable indefinitely. If the change requires adjustments to the website, the security update should be coordinated with the necessary modifications.
What if I do not have access to my website’s server?
In many cases, a website owner does not directly manage the server hosting it. That responsibility often lies with the hosting company or IT service provider.
If this applies to you, you can send them a message like this:
“Hello, I would like to confirm whether the server hosting my website is protected against PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Could you tell me which PHP version we are using and whether the necessary security patches have already been applied?”
The response should help you determine whether your hosting environment is up to date or needs attention.
Simply checking that the website loads correctly is not enough. A website can work normally and still have security vulnerabilities.
Are all WordPress websites at risk?
Not necessarily. WordPress uses PHP, but an installation that already has the relevant security fixes is not exposed to these two known flaws.
Also, updating WordPress, its plugins or its themes is not the same as updating PHP. They are separate components, and server maintenance needs to be reviewed independently.
The alert does not mean that all vulnerable servers have been compromised, either. It highlights a security risk that requires a prompt response.
How to keep your website protected
The disclosure of these vulnerabilities is a reminder that website security depends on more than keeping the content management system up to date. The software running on the server also needs attention.
Regularly checking the PHP version, using compatible components, keeping backups and maintaining clear communication with your hosting provider are all important measures.
In this case, the recommendation from the PHP maintainers and cybersecurity authorities is particularly clear: apply the official fixes as soon as possible and check that services continue to work correctly.
If you are unsure which version is installed, start by checking your website’s control panel or contacting your hosting provider. You do not need to wait for an error to appear before checking whether your website is protected.
