Website security depends on more than strong passwords and regularly updated plugins. The software running behind a website also needs attention, and a recent security warning from the PHP development team has put that responsibility back in focus.
On October 21, the PHP team released security updates addressing two critical vulnerabilities that could allow attackers to execute code remotely without authenticating first. The affected software is used to power web applications and server-side functionality across the internet.
The warning matters to website owners, developers and hosting providers because the issue sits within the PHP runtime itself, rather than being limited to a particular website theme or plugin.
What happened?
The PHP development team published fixes for two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
According to the official security advisory, the flaws involve problems with internal memory handling and the management of application state between requests. Under certain conditions, these issues could create a path for remote code execution.
In practical terms, remote code execution can allow an attacker to make a vulnerable server run unauthorised code. The consequences depend on the server’s configuration, permissions and the attacker’s ability to exploit the weakness.
The PHP team released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators using older versions should check the official advisory and their software vendor’s guidance to determine the appropriate fix.
The advisory also warns that PHP installations serving web requests are potentially exposed, with risk varying by deployment configuration.
Why has this become a wider concern?
PHP is a server-side programming language used by many websites and web applications. A vulnerability in the runtime can therefore have implications beyond a single product or service.
The response has already illustrated how security decisions can affect services people rely on.
Reuters reported that several organisations temporarily suspended online services while investigating or addressing the vulnerabilities. In Japan, SoftBank temporarily suspended its mobile emergency-alert system during maintenance related to the security issue.
These disruptions do not mean every PHP-powered website was compromised. They show that organisations sometimes need to restrict access or interrupt services while assessing a serious vulnerability.
Reuters also reported that the flaws were uncovered using AI-assisted analysis, highlighting how AI is becoming relevant to both vulnerability discovery and the wider cybersecurity landscape.
What should website owners do?
The immediate priority is to establish whether the server is running an affected PHP version and whether the necessary security fix has been applied.
Website owners who manage their own servers should work with their technical teams to review the official advisory, identify the installed PHP version and apply the appropriate vendor-supported update.
If your website runs on managed hosting, contact your hosting provider and ask it to confirm that the PHP security patches have been applied to the environment serving your site.
For WordPress users, there is an important distinction: updating WordPress itself does not necessarily update the PHP version running on the server. These are separate maintenance tasks.
A practical checklist:
- Check the PHP version: Confirm which version your hosting environment uses.
- Verify the patch: Ask your hosting provider or administrator whether the relevant security fixes have been applied.
- Review outdated software: Identify unsupported PHP versions and discuss a supported upgrade path with your provider.
- Check for suspicious activity: Review available server logs and security alerts for unusual activity, especially if the environment was exposed before patching.
- Maintain backups: Keep recent, tested backups so you can recover if a security incident affects your website.
Avoid making server-level configuration changes without understanding their consequences. Some temporary mitigations can reduce exposure, but the PHP team says updating is the complete solution.
What about older PHP versions?
The situation can be more complicated for websites running older releases.
PHP 8.1 and earlier no longer receive updates directly from the PHP project, although some operating-system vendors and long-term-support providers may supply backported security fixes.
That means website owners should not assume that every older installation is either patched or unprotected based solely on its version number. The relevant question is whether a trusted vendor has supplied and applied a fix for that specific environment.
If your hosting provider cannot confirm the security status, ask for a clear remediation plan rather than relying on general assurances that the server is maintained.
Does this mean PHP websites are unsafe?
No. A disclosed vulnerability does not mean every website using PHP has been attacked or is currently compromised.
The risk depends on the software version, server configuration, available fixes and whether an attacker can reach the vulnerable code path. However, the severity of these vulnerabilities makes verification and prompt remediation important.
The incident is also a reminder that cybersecurity is an ongoing operational responsibility. Even established software needs maintenance, and a website can become vulnerable when its underlying infrastructure falls behind on security updates.
The takeaway
The latest PHP security warning is a practical reminder for anyone responsible for a website: keeping plugins and themes updated is not enough.
Server software needs its own maintenance process, and website owners should know who is responsible for applying security fixes. If you use managed hosting, confirm the patch status with your provider. If you manage your own infrastructure, review the official advisory and update through the appropriate supported channel.
When a critical vulnerability is disclosed, knowing what runs behind your website can make the difference between a quick maintenance task and a prolonged security incident.
Sources for this report