Critical PHP Security Update: What Every Website Owner Needs to Do Now

Body

On 21 October 2026, the PHP project released a security update that every website owner should know about. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says both can allow unauthenticated remote code execution, and it asks all users to update immediately.

In short: If your website runs on PHP, check your version today and make sure your host has applied the fix.

What does that mean in plain language?

Remote code execution means an attacker can make your server run commands of their choosing. Unauthenticated means they don’t need a password or an account to try.

Both flaws are rated critical, at 9.2 out of 10. One involves out-of-memory handling that can corrupt memory and lead to code execution. The other involves stale data that survives after the memory behind it has been freed.

Your PHP version | Fixed release   | Action
-----------------|-----------------|------------------------------------------------
8.5              | 8.5.12          | Update now
8.4              | 8.4.27          | Update now
8.3              | 8.3.36          | Update now
8.2              | 8.2.35          | Update now, then plan a move to a newer branch
8.1 or older     | No fix from PHP | Depends on your host's backport. Plan an upgrade

Is my website affected?

If your site runs on PHP, probably yes, unless the fix has already been applied. WordPress and WooCommerce both run on PHP.

Every PHP version before the fixed releases below is affected, and so is PHP 8.1 or older, unless your host or vendor has added the fix themselves.

Sites built with frameworks like Next.js don’t run on PHP. But any PHP-based site, blog or backend you operate does.

How to check your PHP version

On WordPress: go to Tools → Site Health → Info → Server. The PHP version is listed there.

On a server you manage, run this in the terminal:

bash

php -v

To see exactly what your web server uses (it can differ from the command line), create a temporary file called version.php in your site folder:

php

<?php echo PHP_VERSION;

Open it in your browser, note the version, then delete the file straight away. Don’t leave test files on a live site.

What to do today

1. Find out which PHP version your site runs. Use the steps above, or ask your developer.

2. Ask your host whether the patch is applied. Many providers are rolling it out now. Kinsta, for example, has said interim protections are in place and fixed versions are rolling out version by version. InMotion Hosting had already disabled the PHP setting the known exploit uses, and is rolling out patched builds as vendors publish them.

3. If you manage your own server, update now. Use the table below.

Where your site is hostedWhat to doShared or managed hostingAsk your host to confirm the patch is appliedVPS with cPanel/WHMUpdate through EasyApache 4. cPanel has added the fixed versions and backported the fix to its PHP 7.4, 8.0 and 8.1 packagesLaravel ForgeOpen each server and click Update PHPSelf-managed Linux VPSUpdate through your package manager (see below)

On Debian or Ubuntu, for example (adjust 8.3 to your PHP version):

bash

sudo apt update sudo apt install --only-upgrade php8.3-cli php8.3-fpm sudo systemctl restart php8.3-fpm php -v

On RHEL-based systems:

bash

sudo dnf update "php*" sudo systemctl restart php-fpm

Note: Linux distributions often backport fixes without changing the version number. If your version looks older than the fixed release, check your distribution’s security notice, or search the changelog for the CVE: apt changelog php8.3-cli | grep CVE-2026-109618

4. Don’t rely on workarounds. PHP has published temporary mitigations but describes them as incomplete. Installing the fixed release is the only complete fix.

5. Move off old PHP versions. The PHP project only releases updates for 8.2 and newer. If your site is on 8.1 or older, you depend entirely on your host for protection. Plan an upgrade, and test it first, because older themes and plugins can break on newer PHP.

6. Back up before you update, and keep your CMS, themes and plugins up to date too.

Why this keeps happening, and why it matters

New flaws are found in software every year, and fixes follow. What decides whether your business is affected is how quickly your site gets those fixes.

A compromised site can:

• leak customer data
• serve malware to your visitors
• get blacklisted by Google
• go offline for days

For a shop, church, school or NGO, the damage to trust usually costs more than the repair.

Website security is maintenance, not a one-time setup. A site that is regularly updated and monitored is far harder to attack.

Need help?

At Celestial Web Solutions, we help clients check their PHP versions, apply updates safely and keep their sites monitored. If you’re not sure whether your website is protected, contact us and we’ll check it for you.