Cybersecurity

Critical PHP vulnerabilities: is your website protected?

Two critical vulnerabilities affect PHP, the engine behind many websites. Understand the risks, the updates required and how MYCIO can help.

About prices — Any prices quoted in this article were valid at the time of publication. IT product and service prices change quickly, so these amounts may no longer apply. For current public prices, see Pricing. For services without published prices, contact MYCIO for an up-to-date quote.

View current public pricing ↗
Illustration of a PHP server being protected and updated

Your website working normally does not prove its hosting is up to date. Patches for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were released on 21 October 2026. Here is what this means for your business.

What exactly is PHP?

PHP is a language that runs on the server hosting a website. It generates pages, processes forms and powers applications such as WordPress. It normally works behind the scenes, before a page reaches your browser.

What could these vulnerabilities allow?

The flaws involve PHP’s memory management and internal state. Under certain conditions, a remote attacker without an account can make the server execute code. This is called remote code execution, or RCE. Depending on the permissions of the affected process, data could be exposed or the website’s behaviour altered.

PHP installations handling web requests are at risk. Some configurations are easier to exploit than others, but a website remaining accessible is not proof of protection. Exploitation has been reported; this does not mean every PHP website has been compromised.

Is updating WordPress enough?

No. PHP and WordPress are different layers. These vulnerabilities are not specific to WordPress. Check the PHP runtime at your hosting provider even if your CMS and plugins are up to date. In WordPress, look under Tools → Site Health → Info → Server. Your hosting control panel may also show the version.

What should you do now?

  • Identify websites and applications using PHP, including older subdomains.
  • Ask your hosting provider to confirm that the patches have been applied. The first fixed PHP versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some providers backport fixes into their own packages, so their confirmation also matters.
  • Prepare the update with a backup and compatibility checks, then test the website’s essential features.
  • If immediate patching is impossible, ask your provider to assess exposure and temporary measures. A web application firewall is not a substitute for the patch.

PHP 8.1 and earlier no longer receive fixes from the PHP project. Check whether your vendor provides specific extended support or plan a move to a maintained branch. Always consult the latest advisories: additional recommendations were issued after 21 October.

Unsure about your website or hosting?

MYCIO can help review your environment, coordinate checks with your hosting provider and prepare appropriate next steps. Contact us before changing a configuration you are unfamiliar with.

Email MYCIO · +32 2 899 69 69 · Let’s discuss your website

Already a client? Contact your usual helpdesk: help@mycio.eu.

Information checked on 29 October 2026. AI-generated illustration.

Official sources

‍