Facts checked against php.net and published security reports on 22 October 2026.
Big news in the world of websites this week. I've seen plenty of critical vulnerabilities in plugins over the years, but this one is in the core code itself. That's rare, and it's why governments around the world took their own websites offline as a precaution while they patched.
Here's what happened, whether it affects you, and what to ask whoever looks after your website.
What happened?
Two flaws in PHP, known as CVE-2026-109618 and CVE-2026-109619, both let an attacker run their own code on a web server without logging in. Both are rated 9.2 out of 10 for severity. They affect PHP 5.4 and later, which covers almost every PHP website still running.
The PHP team announced them on 21 October and released fixed versions the same day. Government agencies in the Netherlands, Finland and Canada took websites offline as a precaution, and the operator of Wikipedia took some systems down until they were patched. Security researchers at Palo Alto Networks' Unit 42 have already seen working proofs of concept, so this isn't theoretical.
Does it affect my website?
If your website runs on PHP and the server hasn't been updated since 21 October, yes.
| Your website runs on | Runs on PHP? | What to do |
|---|---|---|
| WordPress (including WooCommerce) | Yes | Ask your host or developer to update PHP |
| Craft CMS | Yes | Ask your host or developer to update PHP |
| Drupal or Joomla | Yes | Ask your host or developer to update PHP |
| Magento (Adobe Commerce) | Yes | Ask your host or developer to update PHP |
| Shopify, Wix or Squarespace | Not on your side | Nothing. The platform runs and patches its own servers |
| Something custom-built | Ask | Ask your developer what language it's written in |
Not sure what your site is built on? Your developer will know. If you have a login, the admin screen usually gives it away.
What needs to happen?
The fix is a PHP update on the server to one of these versions, or later:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
This is a server change, so it's your host's or developer's job. It isn't a button in the WordPress or Craft dashboard, and updating your plugins won't fix it.
Some managed hosts apply updates like this automatically. Many cheaper hosts don't, and leave it to whoever manages the site. Don't assume: ask.
What if my site is on PHP 8.1 or older?
Then there's no official fix. The PHP project no longer updates 8.1 and older. Its security team has published unofficial patches for 7.4, 8.0 and 8.1, and some Linux distributions and support vendors offer their own, but neither is a long-term answer.
The real fix is moving the site to a supported version of PHP. That can mean updating the CMS and its plugins first, because older ones may not run on newer PHP, so it's a small project rather than a five-minute job. It's worth doing anyway: PHP 8.2 reaches end of life on 31 December 2026, so aim for 8.3 or later.
A site still on PHP 8.1 or older is usually a sign nobody has been watching the server for a while. That's the bigger issue to fix.
What should I ask my developer or host?
Five questions, by email, so you have the answers in writing:
- Which version of PHP is our website running?
- Has it been updated since 21 October 2026 to fix CVE-2026-109618 and CVE-2026-109619?
- If not, when will it be done?
- Is our version still supported? If not, what's the plan to move to PHP 8.3 or later?
- Who gets the alert when something like this happens again, and how quickly do they act?
A good host or developer will answer all five in a line each.
How I handled it
I patched every site I host before the fix was a day old. That's what a care plan is for: someone watching the servers, acting on security releases, and telling you once it's done, so you hear about the fix, not the breach.
If you'd like that for your site, my managed hosting starts from $169 a month ex GST. See website maintenance and care plans for what's included.
Where to from here
If you're not sure who looks after your website's server, or the answers to those five questions don't come back clearly, get in touch and I'll help you find out where your site stands. If you'd like a broader look at your site's security, speed and setup, a website health check covers the CMS, integrations and hosting along with everything else.
