As of 25 October 2026. Based on php.net, CERT-SE, CERT-EU and IMY. Sources are listed at the end.

On 21 October 2026, PHP released urgent security updates for two critical vulnerabilities. Both are rated 9.2 out of 10, and according to CERT-EU both can be exploited remotely without logging in. An attacker can run their own code on the web server just by sending a request to the site.

PHP is the programming language WordPress is built on, and many local businesses have their website in WordPress on shared hosting. Here is how to tell whether your website is affected and what to do.

What happened?

The PHP project announced an upcoming security release on 20 October and published it on 21 October. The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. One concerns how PHP handles a request that uses too much memory, for example while a form with a file upload is being read. The other concerns data from an earlier request that stays in memory and can be used by the next one.

CERT-SE, Sweden’s national computer emergency response team, issued a flash alert the same day, and IMY, the Swedish data protection authority, warned the day after. In its update of 23 October, CERT-EU says technical details and proof-of-concept code are already circulating, which in its view raises the likelihood that the vulnerabilities are being exploited.

Is my website affected?

The site is built inAffected?Who updates?
WordPress, WooCommerce, Joomla or Drupal on shared hostingYes, if PHP is not updatedUsually the host, but ask
WordPress on your own server or VPSYes, if PHP is not updatedYou, or whoever runs the server
Wix, Squarespace or ShopifyThe platform runs its own serversThe platform. You cannot do it yourself
A static site that does not run PHPNoNo action needed

According to CERT-EU, every PHP installation that serves web requests is at risk, whether the server uses PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. The risk is highest with mod_php.

Which PHP version is safe?

According to php.net, these versions or later: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project. PHP 8.2 also gets its last security updates on 31 December 2026.

Email your host

Hi! Our website [address] is hosted with you. Have you installed PHP’s security update from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) on the server it runs on? Which exact PHP version does it run now? Thanks!

Watch out for fake emails

IMY reminds us that fraudsters tend to exploit big security events. Expect emails, texts and calls claiming to be from your host, WordPress or a security company asking you to click a link or install an update. Only get updates from your vendor or known sources, and log in to your hosting control panel yourself rather than through a link in an email.

If something has already happened

If the site looks odd, redirects visitors elsewhere or Google warns that it is unsafe, contact your host or whoever runs the site right away. If personal data about customers may have leaked, it can be a personal data breach, which under the GDPR must be reported to IMY within 72 hours of becoming aware of it. This is a summary, not legal advice.

The sites we build are static and do not run PHP, so these particular vulnerabilities do not affect them. But many local businesses run WordPress, and it is easy to miss a security update that someone else is supposed to handle.

Frequently asked questions

Which websites are affected by the PHP vulnerabilities?

Every website where the server runs PHP to answer visitors, according to CERT-EU. That includes WordPress, WooCommerce, Joomla and Drupal. Sites on services like Wix, Squarespace and Shopify are run by the platform, and you cannot update PHP there yourself. Static sites that do not run PHP are not affected.

Which PHP version is safe?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later, according to php.net on 21 October 2026. PHP 8.1 and older no longer receive updates from the PHP project, so sites on those versions need upgrading or a fix from their vendor.

How do I see which PHP version my WordPress site runs?

In the WordPress dashboard under Tools and Site Health, on the Info tab in the Server section. It often shows only the main version, such as 8.3, so also ask your host whether the security update from 21 October is installed.

What do I do if I think the site has already been hacked?

Contact your web host or whoever runs the site right away. If personal data about customers may have leaked, it can be a personal data breach, which under the GDPR must be reported to IMY, the Swedish data protection authority, within 72 hours.

Sources

All pages read 25 October 2026.