our blog

On 21 October 2026, the PHP development team released an urgent security warning affecting websites and applications running PHP. Two newly disclosed vulnerabilities could allow hackers to execute malicious code on vulnerable servers without needing a username or password.

And we're not talking about minor technical bugs here. Both vulnerabilities received a critical CVSS 4.0 severity score of 9.2 out of 10.

If your business website runs on WordPress, WooCommerce, Magento, Drupal or another PHP-based platform, this is something you should check immediately.

The worrying part? Your website could look perfectly normal while the underlying PHP installation remains vulnerable.

Let's look at what happened, which websites face potential risks, and what you should do about it.
 

What Happened With PHP on 21 October 2026?

The PHP security team disclosed two critical vulnerabilities, identified as:

• CVE-2026-109618: A memory corruption vulnerability involving PHP's handling of out-of-memory conditions.
• CVE-2026-109619: A vulnerability involving internal request state that can remain accessible after its associated memory has been freed.

Both issues can potentially allow unauthenticated remote code execution (RCE).

In simple terms, under the right conditions, an attacker could exploit a vulnerable PHP installation to run code on the server without logging into the website.

The PHP development team issued emergency security releases and urged users to update immediately.

You can read the full technical details in the official PHP security advisory.
 

Which PHP Versions Are Affected?

The PHP team released four security updates on 21 October 2026.
 

PHP version	Security update required
PHP 8.2	Update to 8.2.35
PHP 8.3	Update to 8.3.36
PHP 8.4	Update to 8.4.27
PHP 8.5	Update to 8.5.12

If your website runs an earlier patch release within any of these branches, you should arrange an update as soon as possible.

Older PHP branches, including PHP 8.1 and PHP 7.x, have already reached end of life and don't receive normal security releases from the PHP project.

Some hosting providers may supply their own backported security patches, but businesses shouldn't assume those protections exist without checking.

The PHP Foundation's explanation of the October security release provides additional technical background.
 

Which Website Platforms Could Be Affected?

These vulnerabilities exist within PHP itself, rather than within one particular content management system.

That means several popular website platforms could face exposure if their hosting environments run vulnerable PHP versions.
 

Website platform	Potential exposure
WordPress	Websites using vulnerable PHP installations
WooCommerce	Online shops, checkout systems and customer accounts
Magento / Adobe Commerce	PHP-powered e-commerce websites
Drupal	Websites running vulnerable PHP environments
Joomla	PHP-based websites and applications
PrestaShop	Online stores using affected PHP versions
Laravel	Applications running on vulnerable PHP installations
Custom PHP websites	Bespoke websites, APIs and backend systems

Importantly, using the latest WordPress or WooCommerce version doesn't automatically protect your website from these vulnerabilities.

Your CMS and PHP runtime are separate components.

Even a fully updated website could remain vulnerable if its server continues running an affected PHP version.

Likewise, a website built with React or another JavaScript framework isn't directly affected unless some part of its backend relies on vulnerable PHP.
 

Why Are These PHP Vulnerabilities So Serious?

The biggest concern is the potential for remote code execution without authentication.

Usually, attackers need to find a weakness in a website's application, plugin or login system. These newly disclosed issues affect PHP's internal handling of requests and memory.

The PHP security advisory identifies installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as potentially affected.

The PHP team considers Apache mod_php particularly concerning because researchers demonstrated an attack that could trigger before the website's application code even started running.

Depending on the server's permissions and configuration, successful exploitation could potentially expose sensitive information, compromise website files or allow attackers to interfere with services.

For businesses, the consequences could include website downtime, compromised customer information and interrupted online transactions.

And that's before considering the reputational damage.
 

How Can You Check Whether Your Website Is Vulnerable?

First, find out which PHP version your website currently uses.

For WordPress, navigate to:
Tools → Site Health → Info → Server → PHP version

Alternatively, check your hosting control panel, which may include a PHP selector or server configuration section.

Compare your installed version against the patched releases listed above.

However, checking the version number is only the starting point. Some hosting providers manage PHP updates automatically, while others require manual intervention. Certain managed environments may also apply security fixes without changing the displayed version number.

If you're unsure, contact your hosting provider and ask whether the October 2026 PHP security patches have been applied.

Don't assume your website is safe just because everything appears to work normally.
 

How to Fix the October 2026 PHP Security Issues

The PHP development team has made its position clear: updating PHP is the only complete mitigation for these vulnerabilities.

There are no complete configuration-based workarounds.

For businesses running affected websites, the recommended process is straightforward:

1. Check your current PHP version and confirm whether your hosting provider has applied the security fixes.
2. Create a full website backup, including files and databases.
3. Review compatibility between the patched PHP version, your CMS, plugins, themes and custom code.
4. Test the update on a staging website where practical.
5. Apply the relevant patched PHP release without unnecessary delay.
6. Test important functionality, including contact forms, payments, bookings, logins and third-party integrations.
7. Monitor website and server logs for errors or suspicious activity following the update.

For managed hosting environments, your provider may handle the PHP runtime update. However, you should still confirm that the patch has reached your website.

Developers using deployment platforms may need to rebuild or redeploy their applications to pick up the fixed runtime. For example, Heroku's October 2026 security update specifically instructs customers to redeploy their applications.
 

Don't Wait Until Something Goes Wrong

One thing I've learned from working with business websites is that technical problems rarely arrive at a convenient time.

You might have Google Ads campaigns running, customers submitting enquiries or an online shop processing orders. The last thing you need is a server vulnerability putting everything at risk.

These October 2026 PHP vulnerabilities deserve immediate attention because they affect the underlying technology rather than just an individual website plugin or theme.

A quick PHP version check could reveal whether your website needs an urgent update. And if it does, the priority should be applying the security fix safely and promptly.
 

Need a PHP Security Audit or Website Fixes? Contact DigiGrow

Not sure whether your website is affected by the October 2026 PHP vulnerabilities? Or perhaps your hosting provider has recommended an urgent PHP update, but you're worried about breaking your website?

At DigiGrow, we help Irish businesses identify technical website issues, review PHP compatibility, troubleshoot errors and carry out website updates. Whether you use WordPress, WooCommerce or a custom-built platform, our web development services can help you understand the risks and take the necessary steps to protect your website.

Contact DigiGrow today for a PHP security audit, website compatibility review or assistance applying the latest security fixes. When it comes to critical vulnerabilities, prevention is a lot better than dealing with the aftermath.