Millions of Websites at Risk From Critical PHP Security Flaws: What Website Owners Should Do

Two critical security vulnerabilities in PHP, a programming language widely used to power websites and web applications, have prompted urgent warnings for website owners and server administrators.

The flaws could allow attackers to execute malicious code remotely on vulnerable servers without first logging in. The PHP development team released security updates on October 21, 2026, and is urging users to install the appropriate fixes as soon as possible.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. Both have received a severity score of 9.2 under CVSS version 4.0, placing them in the critical category.

What Are the PHP Security Vulnerabilities?

PHP is a server-side programming language used by websites, content management systems, online stores and many other web applications. Because it runs on web servers, a serious flaw in its underlying runtime can potentially affect many different websites.

According to the PHP security advisory, the two vulnerabilities involve problems with memory handling and the way PHP manages internal request data.

• CVE-2026-109618: A memory-related error involving out-of-memory handling can leave internal request data only partially initialized, potentially causing unsafe processing during cleanup.
• CVE-2026-109619: Internal state associated with a request may remain available after its memory has been freed, creating a risk that a later request could use stale data.

Under certain conditions, these weaknesses can lead to remote code execution. That means an attacker could potentially run commands on a vulnerable server, rather than being limited to viewing a website or submitting ordinary requests.

The PHP team has warned that the risk is particularly serious for some Apache configurations using mod_php, where a demonstrated exploit can trigger before application code runs.

Which PHP Versions Need an Update?

The PHP project released patched versions of its supported release branches on October 21, 2026.

Website administrators should check the PHP version actually running on their hosting environment and install the relevant security update.

Systems using older PHP versions may need special attention. The PHP project does not provide routine security updates for every older branch, although some operating-system distributors and long-term-support providers may supply their own fixes.

Administrators should consult their hosting provider or software vendor if their version is not listed above. Simply installing the newest major PHP version without checking compatibility may disrupt older applications, so updates should be planned and verified carefully.

Why Could Millions of Websites Be Affected?

PHP is used across a large part of the web, including websites built with content management systems and custom applications. A vulnerability in the PHP runtime can therefore have a much broader potential impact than a flaw limited to one plugin or website theme.

Security researchers have reported a large number of internet-facing PHP servers running potentially affected software. However, estimates based on publicly identifiable servers are not a definitive count of compromised websites, and not every vulnerable installation has necessarily been exploited.

The important distinction is that being vulnerable does not automatically mean a website has been hacked. The level of risk depends on factors such as the PHP version, server configuration, exposure to incoming requests and whether the relevant security fix has been applied.

What Should WordPress Website Owners Do?

WordPress websites commonly rely on PHP, so site owners should confirm which PHP version their hosting environment uses. Updating WordPress itself does not necessarily update the PHP runtime on the server.

Website owners can take these steps:

1. Check the PHP version: Use the hosting control panel or ask the hosting provider which PHP runtime is active for the website.
2. Contact the hosting provider: Ask whether the server has been patched for CVE-2026-109618 and CVE-2026-109619.
3. Install the relevant security update: If you manage your own server, apply the appropriate vendor-supported PHP update as soon as possible.
4. Back up the website: Keep a recent backup of the database and website files before making changes.
5. Test the website: Check the homepage, WordPress dashboard, forms, plugins and other important functions after the update.
6. Review security logs: Look for unusual requests, unexpected file changes, unfamiliar administrator accounts or suspicious server processes.
7. Keep other components updated: Install supported updates for WordPress, themes, plugins, operating-system packages and other server software.

If your website is hosted on a managed platform, the provider may handle PHP security updates centrally. Even so, ask for confirmation rather than assuming that the server has already been patched.

Can a Security Plugin Protect a Website From These Flaws?

Security plugins, web application firewalls and monitoring tools can help identify suspicious activity and block some malicious requests. They should not, however, be treated as a replacement for updating a vulnerable PHP runtime.

The PHP project has stated that there are no complete mitigations for these vulnerabilities. Applying the relevant security fix is therefore the primary recommended response.

Website owners should also avoid relying solely on a security plugin’s dashboard status. A plugin may report that WordPress core is updated while the server continues to run a vulnerable PHP version.

What Happens if a Vulnerable Server Is Compromised?

Successful remote code execution can have serious consequences, depending on the permissions available to the attacker and the server’s configuration.

Potential consequences include unauthorised changes to website files, the installation of malicious scripts, theft of data accessible to the application, or attempts to gain further access to the hosting environment. These are possible outcomes of server compromise, not evidence that every vulnerable website has experienced them.

If a website shows signs of compromise, its administrator should contact the hosting provider or a qualified security professional, preserve relevant logs, investigate the cause and rotate affected credentials from a trusted device after securing the environment.

The Bottom Line

The two PHP vulnerabilities are serious because they can potentially enable unauthenticated remote code execution on affected systems. Security updates are available for PHP 8.2, 8.3, 8.4 and 8.5 through the patched releases listed above.

Website owners should verify their active PHP version, confirm that the hosting environment has been updated and investigate any signs of suspicious activity. For WordPress users, checking the server’s PHP version is just as important as keeping the website’s themes, plugins and core software current.

Editorial note: Security details and patched versions should be checked against the official PHP security advisory and the website’s hosting provider before publication or implementation. The existence of a vulnerability does not by itself establish that a particular website has been compromised.