Security and maintenance
Two critical PHP vulnerabilities: how can you protect your website?
October 2026 PHP vulnerabilities: fixed versions, hosting checks and update steps for your WordPress website or PHP application.
My website uses PHP: what should I do now?
Ask your hosting provider or technical lead to confirm that both CVE-2026-109618 and CVE-2026-109619 have been fixed in the environment actually serving your website. The fixed PHP versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; a vendor package may also include backported fixes. Updating WordPress or its plugins does not update PHP. Have someone verify that the patch has been applied, the affected processes have been restarted and the website’s essential user journeys still work.
A security alert quickly raises practical questions for a business: is our website affected, who needs to act and how can we check that the issue has been addressed? The two critical PHP vulnerabilities announced in October 2026 call for prompt action coordinated with whoever manages the hosting environment.
This update, checked on 23 October 2026, sets out the available fixes, the checks to request and the arrangements to put in place afterwards. It also explains which Oryon services can help assess your environment, apply updates and maintain your infrastructure.
Two confirmed vulnerabilities, with fixes already available
The PHP security advisories identify CVE-2026-109618, involving the handling of an out-of-memory condition, and CVE-2026-109619, involving internal state retained between requests. Both are rated critical, with a CVSS v4 score of 9.2 out of 10. Successful exploitation can allow code execution on a vulnerable server without authentication.
The risk concerns PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, CGI, FrankenPHP and LiteSpeed. Exploitation conditions vary by environment. On 22 October, CERT-FR reported proof-of-concept exploits for certain deployments; this does not establish how many websites have actually been compromised.
Almost 70%: a usage figure, not a count of hacked websites
As of 23 October 2026, W3Techs estimates that PHP is used by 69.3% of websites whose server-side programming language is known. That scope matters: the figure represents neither all websites nor an inventory of installations that remain vulnerable.
For your business, the useful question is therefore about your own installation. A WordPress logo, a page responding normally or a version shown by a public tool is not enough to confirm that both fixes have been applied.
Which PHP versions fix these vulnerabilities?
The PHP project released the following versions on 21 October 2026. For an installation distributed directly by PHP, check which branch you use and install a fixed version of that branch, or a later version compatible with your application.
Linux distributions may backport a fix without adopting that version number. Ubuntu, for example, fixed both CVEs in package 8.3.6-0ubuntu0.24.04.13 for Ubuntu 24.04. Ask for the full package version and the corresponding vendor advisory before drawing conclusions from the PHP version number alone.
PHP 8.1 and earlier branches are no longer covered by the PHP project’s general support. Targeted backports exist, but they do not restore that support: check your vendor’s coverage and plan a compatible migration. PHP 8.2 reaches the end of support on 31 December 2026.
| PHP branch | Fixed version |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
An action plan for your website or application
Start by identifying who can change the PHP environment. On shared hosting, this is usually the hosting provider’s responsibility. On a server managed by your business, coordinate the work with your technical lead or managed services provider. The company that edits your pages does not necessarily have control over the server.
- Inventory the affected PHP websites, subdomains and applications, including forgotten environments that remain accessible.
- Obtain confirmation covering both CVEs, the installed package or image and the actual web environment. The command-line version may differ from the one used by the website.
- Check that a usable backup and a recovery procedure exist, then prepare compatibility tests. Keep this preparation proportionate to the urgency.
- Apply the patch agreed with the hosting provider. For a container, update its image, then rebuild and redeploy the affected instances.
- Restart the affected PHP or web processes according to the environment’s procedure, then confirm which version or package is actually loaded.
- Test forms, sign-in, administration and, for a shop, the checkout journey. Record the results, the time of the intervention and any outstanding issues.
Why a WordPress update or a firewall is not enough
WordPress, its plugins, its theme and PHP are separate components. An up-to-date WordPress dashboard does not confirm that the PHP environment has been patched. Both layers need maintenance, with a compatibility check before changing PHP branches.
PHP states that no mitigation provides complete protection in place of updating. CERT-FR describes temporary workarounds that have not been validated: some reduce only part of the attack surface and may disrupt website features. A web application firewall may contribute to temporary protection, but it does not replace the patch.
If an immediate fix is impossible, agree any necessary restrictions or temporary isolation with whoever manages your hosting. If there are signs of an intrusion, an update alone does not prove that the server is clean: preserve the available logs and have the incident investigated.
After the emergency: know who is responsible for updates
Useful maintenance leaves clear records: the components covered, who is responsible for them, the work performed and the checks carried out. It also plans for replacing versions that reach the end of support. Without this framework, an alert may reveal a website whose hosting environment nobody knows how to update.
Ask for a written scope: PHP and the operating system, the CMS and plugins, custom code, backups, restore tests and monitoring. Specify who receives alerts and who authorises urgent work. The expected outcome is a usable, documented procedure; no service can promise the absence of all vulnerabilities.
How Oryon can help
Unsure which version your website runs, who manages PHP or which updates to prioritise? An Oryon technical audit assesses the agreed scope, ranks the risks and recommends actions. The audit and the implementation of fixes are services whose scopes need to be defined separately.
For Linux servers, our managed services combine inventory, updates, monitoring and backups with tested restoration. For WordPress websites, our support includes takeover, security improvements and maintenance, with preparation and checks as set out in the quote. Together, we establish which responsibilities concern the hosting provider, the website and custom code.
To prepare for the discussion, provide the website address, your hosting provider, the CMS if you know it and any response you have already received about these two CVEs. Do not send passwords through the contact form. We can then define the checks and work appropriate to your situation.