PHP Update: Critical Security Vulnerabilities in October 2026

The PHP update released on October 21, 2026, fixes two critical security vulnerabilities that can allow attackers to execute code remotely on a web server under certain conditions. Website owners should check the PHP version actually running their site, confirm its security patch status with their hosting provider, and have available updates installed immediately. Even a fully updated WordPress website needs this server-side update.

Why the latest PHP update is urgent

PHP runs the server-side code behind many websites, including WordPress and WooCommerce. The latest fixes address this underlying runtime. The attack paths described in the advisories do not require an account on the website.

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. The official advisories rate both as critical, with a CVSS v4.0 score of 9.2 out of 10. The first vulnerability involves the handling of out-of-memory errors. The second can leave invalid internal state in place between requests.

Affected environments include PHP-FPM, Apache with mod_php, CGI, FrankenPHP, and LiteSpeed when serving web requests. The PHP project highlights mod_php in particular: its technical security advisory describes demonstrated remote code execution that can occur before the website’s own code starts running. This does not establish that every website has already been attacked. It does explain why the update is a high priority.

Updating WordPress, a theme, or a plugin alone does not fix these PHP security vulnerabilities. The patched PHP runtime must be installed on the server and active for the website. The affected PHP processes also need to be restarted after the update. A security plugin cannot replace this work.

Which PHP versions fix the vulnerabilities?

The PHP project published the following security releases on October 21, 2026. The table also shows how long each branch receives security updates, according to the official PHP support schedule.

PHP branch	October 21, 2026 security release	Security support ends
PHP 8.2	8.2.35	December 31, 2026
PHP 8.3	8.3.36	December 31, 2027
PHP 8.4	8.4.27	December 31, 2028
PHP 8.5	8.5.12	December 31, 2029

These patch versions fix the two vulnerabilities discussed here in their respective branches. Any subsequent security updates also need to be considered. See the PHP release announcements for October 21 for details.

Linux distributions and hosting providers sometimes backport security fixes into packages that retain an older version number. An older displayed version can therefore contain the required corrections. If the version number differs from the table, ask your provider to confirm explicitly whether both CVEs have been fixed. A label such as “PHP 8.3” does not answer that question.

How to check your website’s PHP version

What matters is the PHP version executing your particular website. Several versions can be installed on the same hosting account. Your main domain, subdomains, and staging environment may also use different settings.

Check the PHP version in WordPress

WordPress usually lets you check the version without installing another plugin or creating a test file:

1. Sign in to the WordPress dashboard with an administrator account.
2. Open Tools → Site Health.
3. Select the Info tab and expand the Server section.
4. Find PHP version and note the complete version number.

The WordPress documentation for Site Health explains these system details. A general notice recommending a PHP version does not confirm that the latest security patches are installed.

Check the PHP version with a phpinfo file

If you have access to the website’s files, you can also inspect the environment with phpinfo(). Use a directory that is protected by a password or IP restriction and served by the same PHP runtime as your website. The output contains technical server information and should never remain publicly accessible.

Create a file named phpinfo-check.php in a text editor with this content:

<?php
phpinfo(INFO_GENERAL);

Upload it through SFTP or your provider’s file manager to the protected directory. Then open its HTTPS address in your browser. For a protected directory named diagnostics, an example would be https://your-domain.example/diagnostics/phpinfo-check.php. The PHP version appears at the top of the output.

The INFO_GENERAL parameter limits the output compared with a full phpinfo(); call. Even this reduced output includes server details and configuration paths, as the PHP manual for phpinfo() explains. Delete the test file immediately after checking the version, then confirm that its address is no longer accessible.

If you only need the version number, this alternative exposes less information:

<?php
header('Content-Type: text/plain; charset=utf-8');
header('Cache-Control: no-store');
echo PHP_VERSION;

Delete this file after use as well. If you cannot set up a protected directory, use the WordPress report or ask your hosting provider. Running php -v over SSH shows the PHP CLI version, which may differ from the version serving your website.

Updating PHP: a security patch or a version upgrade?

A patch within a branch, such as updating PHP 8.3.35 to 8.3.36, differs from migrating PHP 7.4 to PHP 8.4. Security updates should be applied promptly and checked afterward. Moving to a different branch can also require changes to the application code.

For WordPress, compatibility depends on the combination of WordPress itself, themes, plugins, and custom extensions. Outdated code can cause an HTTP 500 error after a PHP upgrade, prevent forms from working, or interrupt the WooCommerce checkout.

For a version upgrade, use the following process:

1. Back up the files and database, and establish a working recovery procedure.
2. Create a protected copy of the website as a WordPress staging environment.
3. Prepare WordPress, themes, plugins, and custom PHP code for the target version. Replace or update extensions that are no longer maintained.
4. Activate the target PHP version on staging and review the error logs.
5. Test sign-in, content editing, forms, email delivery, search, and, where applicable, the cart, payment flow, and order confirmation. Prevent payment and email tests from triggering unintended real transactions or messages.
6. Coordinate the production upgrade with your hosting provider. Then verify the active PHP version again and test the most important workflows on the live website.

A longer migration must not delay immediate protection against a critical vulnerability. In parallel, ask your hosting provider which patched package can be installed right away. According to the PHP project, configuration changes that reduce exposure to individual attack paths do not replace a complete security update.

Upgrading PHP 7.4, 8.0, or 8.1 to a supported version

PHP 7.4, PHP 8.0, and PHP 8.1 no longer receive regular security updates from the PHP project. As an exception for the current vulnerabilities, the project has published minimal source-code fixes for these old branches, as described in its October 21 security announcement. This does not restart regular support. You need to ask your hosting provider whether it supplies a suitable backport.

For a longer-term solution, migrate to a supported PHP branch. PHP 8.2 is still supported as of October 21, 2026, but its security support ends at the end of the year. For a new migration, we therefore recommend evaluating PHP 8.3, 8.4, or 8.5 as the target. PHP 8.2 is only a short-term transitional option. Choose based on tested compatibility with your website and the remaining support period.

Bajorat Media helps with PHP upgrades even if you are not an existing client. We investigate compatibility, adapt custom code, and resolve problems with themes or plugins. If you use an external host, we coordinate the technical requirements with your provider; the responsible server operator approves and installs the server-side update.

If your website stops working after a PHP update or an old extension blocks the migration, our WordPress support service can help diagnose the problem. We handle more extensive changes through WordPress development. When you send a project inquiry about a PHP upgrade, include your website address, hosting provider, and current and intended PHP versions.

Important information for Bajorat Media clients

Our own servers have already been updated. The servers we operate for clients have also received the relevant PHP security updates.

If your website is hosted by another provider, you must arrange the PHP update directly with that hosting provider. This also applies if you have an active maintenance contract with Bajorat Media. Ask your hosting provider to confirm that the PHP environment serving your website has received the fixes for CVE-2026-109618 and CVE-2026-109619.

An active WordPress maintenance contract does not give us control over another hosting provider’s servers. We cannot install server-side PHP updates there or require the hosting provider to make them available. You therefore need to arrange the update with your hosting provider. We remain available to help with compatibility questions and any changes your website needs.

You can send your hosting provider the following request:

Please confirm whether the PHP environment serving my website is protected against CVE-2026-109618 and CVE-2026-109619. Which PHP version, including the package or backport revision, is active for my domain? If the fixes are missing, when will they be installed and the affected PHP processes restarted?