Urgent PHP Security Update: Is Your Website Affected?
October 21, 2026Check your website
Enter your website address. We'll check public headers, platform clues, and robots.txt for signs your site may need the PHP update.
Read our PHP security update post for the risks, affected versions, and how we can help.
What to do next
What we checked and found
Need a hand? Email Nick or use our contact form. Include your website address and any hosting details you have.
Check your website above. The tool looks for public PHP version information and platform clues. It cannot confirm every server's patch status; if the result is unclear, ask your administrator or technical contact, or contact us with your website and hosting details.
If your business runs a WordPress website, an online store, or a custom PHP application, contact your hosting provider or developer today to confirm that your server has received the latest PHP security fixes.
On October 21, 2026, PHP released emergency updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws can allow attackers to run code on an affected server without logging in. The PHP team is urging users to update immediately. Read PHP's official security advisory.
Why this matters to your business
PHP is software running behind the scenes that helps websites process forms, load content, and interact with databases. A vulnerability at that level can put the website and the information it can access at risk.
If an attacker successfully exploits these flaws, they could potentially change your website, install malicious code, access sensitive information available to the application, or disrupt your services. For a business, that can mean missed inquiries, interrupted sales, recovery costs, and lost customer trust.
The exact exposure depends on the server's configuration. PHP identifies Apache's mod_php as the highest-risk setup, with a demonstrated attack that can happen before the website's own code runs. Other PHP web server setups also need attention. PHP's technical advisory explains the risk.
A website that looks normal can still need this update.
What types of websites should be checked?
PHP powers many familiar website platforms. Sites to check include:
- WordPress business websites and blogs, which require PHP on the server.
- WooCommerce online stores, which also depend on PHP.
- Drupal and Joomla websites, including organizational and community sites. Both platforms publish PHP requirements: Drupal and Joomla.
- Custom PHP websites and applications, such as customer portals, booking systems, and business tools.
If your site has been kept on an older PHP version because a theme, plugin, or custom feature breaks when it is upgraded, make checking it a priority. Recently maintained sites need checking too: using PHP 8 does not automatically mean these fixes are installed.
Using one of these platforms does not establish that your site is vulnerable. Your host may already have applied the patch. Ask them to confirm.
Which PHP versions need updating?
For the supported PHP branches, the security fixes released October 21 are:
- PHP 8.2.35 for the 8.2 branch.
- PHP 8.3.36 for the 8.3 branch.
- PHP 8.4.27 for the 8.4 branch.
- PHP 8.5.12 for the 8.5 branch.
Earlier releases in each branch need the fixes. PHP's advisory lists the affected and patched versions.
PHP 8.1 and older no longer receive regular updates from the PHP project. Some hosting and operating system vendors supply backported fixes, so ask your provider to verify coverage for both CVEs, rather than relying on the displayed version number alone. See PHP's update guidance.
What should you do now?
Ask your host or developer: “Has the PHP installation serving my website been patched for CVE-2026-109618 and CVE-2026-109619?”
Have them promptly back up the site, check compatibility, apply the appropriate patched release, restart the affected PHP services, and verify important features such as forms, logins, and checkout.
Updating WordPress, themes, or plugins alone does not update the server's PHP installation. PHP also warns that temporary configuration changes do not fully resolve these vulnerabilities. Installing the fixes is essential. Read the official remediation guidance.
We can help you
Unsure what version your website uses, or worried an upgrade could break something? Arcane Web Design can help you check your hosting, update PHP, resolve compatibility issues, and test that your website still works as it should.
Email Nick at nick@arcane-web-design.com or use our contact form to get help with your website's PHP update.
