Critical PHP security update: what website owners should do now

21 October 2026 · Updated 23 October 2026: guidance for unsupported PHP versions.

If your website uses PHP, contact the person responsible for its hosting today and ask for confirmation that the security fixes have been applied.

What to keep in mind as a website owner

If you have come across alarming posts about this issue, there is no reason to assume that your website has already been hacked or your data has been leaked. A vulnerability announcement alone does not prove that such an incident has occurred. You do not need to make rushed decisions, but it is important to contact the team responsible for your website or hosting today and ask for a check and a timely update.

If you receive an offer for paid work, ask for a clear explanation of how the issue affects your website, what work is needed and whether it is included in your current maintenance agreement. Additional costs may be justified depending on the state of your system, but the announcement does not automatically mean that you need a new website, a hosting change or an expensive rebuild.

PHP's 21 October security announcement describes two critical flaws that can let an unauthenticated attacker execute code remotely. It identifies web-serving PHP installations as at risk, including PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed. The team considers mod_php the highest-risk setup.

What has been fixed?

The advisories identify two separate problems:

• CVE-2026-109618: a memory-exhaustion failure can leave internal request data in an invalid state that PHP later uses. See the official memory-handling advisory.
• CVE-2026-109619: internal state from one request can outlive its memory and be accessed by a later request in the same worker. See the official request-state advisory.

A vulnerability announcement is not evidence that your particular website has been compromised. It is a reason to verify and patch the environment promptly.

Which PHP versions contain the fixes?

The PHP security advisory lists these corrected releases for the supported branches:

PHP branch	Security release
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

Some vendors provide backported patches; ask for their security notice rather than judging by the upstream version number alone.

What if your website still runs PHP 7.4, 8.0 or 8.1?

These branches no longer receive normal security releases from the PHP project. PHP 7.4 reached end of life on 28 November 2022, PHP 8.0 on 26 November 2023 and PHP 8.1 on 31 December 2025. Waiting for another regular PHP 7.4 update is not a maintenance plan. See PHP's unsupported-branch table.

There is a specific exception for this incident: the PHP security team supplied minimal emergency source backports for PHP 7.4, 8.0 and 8.1. These are source patches for the two announced vulnerabilities, not a return to normal support or proof that your installed package is fixed. Your hosting provider or a qualified maintainer must apply, build, test and deploy them, or supply a maintained vendor package that includes equivalent fixes. The official announcement links the backports.

A version label such as PHP 7.4.33 cannot establish patch status by itself. Ask the provider for a package revision and written confirmation covering both CVE-2026-109618 and CVE-2026-109619. For other unsupported branches, including PHP 7.3 and older, do not assume the emergency backport exception applies; require evidence for your exact runtime.

If there is no confirmed patched package

1. Arrange a move to a supported PHP branch urgently. Check the CMS, framework, plugins, extensions and custom code in a separate test environment, with a usable backup and recovery plan.
2. Agree how to reduce exposure while that work is completed. If the provider cannot supply a verified fix promptly, discuss restricting public access or temporarily taking the affected application offline. A firewall rule or a configuration change does not prove the interpreter is patched.
3. Deploy and verify the actual running runtime. Include the web-serving processes, scheduled commands and queue workers, then test the customer actions listed below. Updating only the CMS or plugins does not update PHP itself.
4. Set an owner and deadline for the migration. Treat a verified legacy backport as a temporary bridge, with a clear plan for ongoing updates.

When selecting a destination, check the PHP support schedule. PHP 8.2's security support ends on 31 December 2026; PHP 8.4 and 8.5 offer longer support windows where the application is compatible. Install a supported release containing the fixes, or a later supported security release.

Configuration workarounds are incomplete. Follow the PHP team's update guidance; temporary measures do not replace the fixes.

A practical checklist for your business

Our suggested workflow is to give the update a clear owner and finish with recorded verification:

1. List the sites that need checking. Include your main website, shop, booking system, customer portal and any older subdomains. Record who manages each environment.
2. Ask for the running version and patch evidence. Request the version serving web traffic and, where a vendor backport is used, its package revision and security notice. A hosting plan name or an old deployment note is not enough.
3. Arrange the update promptly. Have the responsible team confirm a usable backup, check compatibility and agree on any short maintenance window. Keep testing proportionate to the urgency.
4. Confirm the new runtime is active. Ask the administrator to verify all relevant instances and complete any required service or worker restarts. Do not assume an installed package is already serving every request.
5. Test the customer journey. Check login, contact forms, uploads, bookings, checkout and payment callbacks where your site uses them. Review application errors after the change.
6. Keep a completion record. Note the sites checked, runtime or vendor package, completion time and person responsible. Assign an owner and deadline to any exception.

For managed hosting, start with a support ticket. A useful request is: “Please confirm whether the PHP runtime serving our domains includes fixes for CVE-2026-109618 and CVE-2026-109619, and provide the installed version or vendor package reference.”

This article explains the announcement and a suggested response; it does not confirm the patch status of any individual website. The linked PHP advisories remain the source for technical details.