Two critical vulnerabilities in PHP could allow attackers to execute malicious code on vulnerable servers without authentication. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, and received a critical severity rating of 9.2 out of 10. Emergency security updates are now available, and the risks extend to servers running WordPress, Magento, and other PHP-based applications. Here’s what website owners need to know and how to check whether their websites are protected.
On October 21, 2026, the PHP development team disclosed two critical security vulnerabilities involving memory management.
The vulnerabilities are identified as:
Both vulnerabilities received a CVSS 4.0 severity score of 9.2 out of 10, indicating a critical security risk.
The most concerning aspect is the possibility of exploiting these vulnerabilities without prior authentication.
Under certain conditions, attackers may not need access to a website’s administration panel or valid login credentials.
Successful exploitation could allow malicious code to run on the server, potentially compromising sensitive information or disrupting application functionality.
The risk depends on the PHP version, server configuration, and other security controls.
According to security advisories, potentially affected environments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The vulnerabilities affect PHP itself, which means a website can be at risk even when its CMS, themes, and plugins are fully updated.
The PHP development team released emergency security patches on October 21, 2026.
The following releases contain fixes for CVE-2026-109618 and CVE-2026-109619:
| PHP branch | Security release |
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Earlier releases within these branches require the appropriate security fixes.
Websites running older, unsupported PHP versions should consult their hosting providers or server administrators about available security patches and migration options.
Some hosting providers and operating system vendors backport security fixes without changing the main PHP version number displayed in the hosting panel.
For that reason, checking the version number alone may not be sufficient.
The key is to confirm that the server has received patches addressing both CVE-2026-109618 and CVE-2026-109619.
If you’re unsure which PHP version your website uses, contact your hosting provider or the team responsible for technical maintenance.
Potentially, yes.
WordPress, Magento, Drupal, and many other content management systems rely on PHP to execute server-side application code.
As a result, websites and online stores running these platforms may be exposed if their hosting environments use vulnerable PHP versions.
However, using WordPress or Magento does not automatically mean a website has been compromised.
The actual risk depends on the server environment, PHP version, configuration, and implemented security protections.
The crucial distinction is that updating WordPress, Magento, themes, or plugins does not fix vulnerabilities in PHP itself.
Even a fully updated CMS can run on an outdated and vulnerable PHP installation.
Website owners should therefore verify both their application software and the server technologies supporting it.
At Delante, website security is an important part of our comprehensive development and technical maintenance services.
Our development team has already taken steps to assess the threat and help secure client websites covered by our full development support.
We have also increased security monitoring to identify potential irregularities and respond to emerging risks.
As part of these efforts, our developers reviewed server configurations, checked PHP versions, and assessed potential vulnerabilities across supported environments.
Where Delante is responsible for server administration, our team implemented the necessary security updates and patches directly.
For websites hosted on infrastructure managed by external administrators or hosting providers, we contacted the responsible teams to coordinate updates and verify the status of security measures.
This approach allowed clients covered by our comprehensive development services to receive technical support in assessing the risk and coordinating the necessary actions, including situations requiring involvement from third-party infrastructure providers.
As Robert Smalarz, Senior Web Developer at Delante, explains:
“Website security goes beyond keeping WordPress and its plugins up to date. The server environment is just as important. That’s why, when vulnerabilities like these emerge, we check not only software versions but also potential signs of attacks and the security measures already in place.”
These activities are part of our broader approach to technical website maintenance, which includes ongoing monitoring, regular updates, and responding to emerging security threats.
If you manage a website or an online store, you should verify your PHP environment as soon as possible.
You can usually find your PHP version in your hosting control panel.
For WordPress websites, the information is also available under Tools → Site Health → Info → Server.
If the installation uses an older version, contact your administrator to determine whether an update is required.
Keep in mind that some providers apply security patches without changing the displayed PHP version number. In such cases, request explicit confirmation that both vulnerabilities have been addressed.
Ask your provider whether the server has received security fixes for CVE-2026-109618 and CVE-2026-109619.
You should also confirm:
Do not assume that security patches have been applied automatically, even if you use managed hosting.
If you manage your own server, arrange for the necessary PHP security updates to be deployed without delay.
Before making changes, create a backup and verify application compatibility with the target PHP version.
After the update, test important website functions, including contact forms, integrations, shopping carts, and payment processing.
For e-commerce websites, particular attention should be paid to the checkout experience and order processing.
Applying a security patch addresses the vulnerability, but it does not reveal whether someone previously attempted to exploit it.
Review web server logs, PHP logs, WAF events, and available security monitoring data.
If suspicious activity is identified, further incident investigation may be necessary.
Not every unusual request indicates a successful compromise, but potential indicators of an attack should be investigated.
A Web Application Firewall (WAF) can provide an additional layer of protection against certain exploitation attempts.
Cloudflare has announced protective rules designed to help mitigate known attacks involving the disclosed PHP vulnerabilities.
However, WAF protection is not a substitute for patching PHP.
Even when a website uses Cloudflare or another WAF provider, administrators should verify that the underlying PHP environment has been secured.
On October 23, 2026, the PHP development team issued an additional advisory involving the session upload progress mechanism.
The issue, identified as CVE-2026-115560, describes a specific vulnerability scenario that may also affect certain environments running PHP versions patched on October 21.
This does not mean every updated PHP installation remains vulnerable in the same way.
The issue requires particular application behavior and configuration conditions.
For potentially affected environments, PHP maintainers have recommended disabling the relevant functionality as a temporary risk-reduction measure:
session.upload_progress.enabled=0
Administrators should assess whether this mitigation is appropriate for their applications and follow subsequent PHP security announcements.
The additional warning does not change the need to deploy the updates addressing CVE-2026-109618 and CVE-2026-109619.
PHP vulnerabilities are primarily a threat to website security, data integrity, and business continuity.
However, a successful attack can also affect organic search visibility, advertising performance, and online sales.
A compromised website might experience:
In serious cases, Google may also flag a compromised website as unsafe, potentially discouraging users from visiting it through search results.
For e-commerce businesses, the consequences could include lost orders, checkout disruptions, operational costs, and reduced customer trust.
Importantly, the existence of a vulnerability does not automatically result in lower Google rankings.
Potential SEO consequences depend on whether a compromise occurs and how it affects the website.
The latest PHP security incident highlights why website maintenance should involve more than updating a CMS and its plugins.
A comprehensive approach should also include server software updates, security monitoring, backup management, access controls, and timely responses to emerging threats.
That is why ongoing development support should address both website functionality and the underlying technical environment.
For businesses using WordPress, regular maintenance and appropriate server administration can help identify outdated software and reduce avoidable exposure to known vulnerabilities.
At Delante, our approach to website development and maintenance emphasizes technical reliability, ongoing monitoring, and coordination with the infrastructure providers responsible for each environment.
The objective is to help businesses maintain websites that are secure, stable, and ready to support their marketing and commercial activities.
Security fixes for CVE-2026-109618 and CVE-2026-109619 were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
For older environments, additional vendor patches or migration to a supported PHP version may be necessary.
Website owners should also follow subsequent security advisories, including the additional warning published on October 23.
The most important action is to confirm that your website runs on a patched PHP environment and that any indications of earlier exploitation have been investigated.
If your server is managed by an external hosting provider or administrator, request confirmation that the relevant fixes have actually been deployed.
