If your website runs PHP and is not on 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer, it is exposed to two critical remote-code-execution flaws. On PHP 8.2+ you can update. On PHP 8.1 or older there is no patch: the site must be upgraded to a supported PHP version.
What happened
On October 20–21, 2026, the PHP security team announced two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale. Successful exploitation can let an attacker run their own code on an unpatched web server. Fixed releases were published on October 21.
The situation was serious enough that cybersecurity authorities in the US, Europe and the UK advised organizations that could not patch to consider taking PHP sites offline temporarily, and several government websites in Europe did exactly that.
Who is affected
- Web servers running PHP 5.4 or later that have not been updated to a fixed release.
- All common ways of serving PHP: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP developers rate the risk highest for mod_php, where a demonstrated exploit works with a single unauthenticated request.
- Anything built on PHP: WordPress, Drupal, Joomla, Magento, hosting control panels and many custom business apps.
Am I patched? Quick reference
| Your PHP branch | Fixed in | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update |
| 8.4 | 8.4.27 | Update |
| 8.3 | 8.3.36 | Update |
| 8.2 | 8.2.35 | Update |
| 8.1 and older incl. 7.x, 5.x | No official fix | Upgrade to PHP 8.2+ 8.3 or 8.4 recommended |
PHP 8.1 and older no longer receive updates from the PHP project, and security reporters estimate that a large share of PHP websites still run these older versions. Try our instant version checker →
How to check your PHP version
- WordPress: Tools → Site Health → Info → Server.
- Hosting panel: look for "PHP version", "Select PHP version" or "MultiPHP Manager" in cPanel, hPanel or Plesk.
- Ask your host which PHP version, and which exact sub-release, your account runs.
- Or send us your URL for a free passive check.
If you have SSH access to the server:
# Exact PHP version (command-line build) $ php -v # Is Apache running mod_php? (highest-risk setup) $ apachectl -M 2>/dev/null | grep -i php
phpinfo() file to check, delete it right away.Is it only websites with customer databases?
No. The flaw is in PHP itself, in how the server handles incoming requests, not in the site's data. For the riskiest setup (Apache mod_php), the attack works with a single request before the website's own code even runs. Any server running vulnerable PHP is exposed, whether it stores customer data or nothing at all.
Showroom and brochure sites are affected too if they run on PHP, as every WordPress site does. There's no customer data to lose, but an attacker who takes the server can:
- deface the site or inject malware that infects visitors,
- add hidden spam pages, which wrecks the site's Google ranking,
- host phishing pages on the owner's domain,
- get the site flagged by Google as harmful, or suspended by the host.
The exception: a site that's pure HTML with no PHP on the server is not affected.
Which fix does my site need?
| Your situation | Fix | Price |
|---|---|---|
| PHP 8.2 – 8.5, older sub-release | Emergency Patch & Verify | $249 |
| PHP 5.x – 8.1 (WordPress, Joomla, custom) | Legacy PHP Upgrade | from $890 |
| Brochure or showroom site | Static Rebuild: no PHP at all | from $490 |
| Drupal, Magento, multisite, VPS | Complex Stack Rescue | from $1,900 |
Running WordPress? Read how to update WordPress to a patched PHP version without breaking it.
Why upgrading from old PHP is not a one-click job
Moving from PHP 7.x or 8.0/8.1 to 8.3 removes and changes functions that older themes, plugins and custom code depend on. A direct switch can cause white screens, broken forms or failed checkouts. The safe method is to copy the site to staging, upgrade there, fix every incompatibility, test, then switch the live site with a rollback ready.
What to do while you wait
- Take a full backup of files and database now.
- Put the site behind a web application firewall. Cloudflare reported deploying firewall rules against attack traffic for these flaws.
- Review your server and admin accounts for anything you don't recognize.
Frequently asked questions
What are CVE-2026-109618 and CVE-2026-109619?
Two critical vulnerabilities in PHP, announced on October 20–21, 2026 and each rated 9.2 on the CVSS v4.0 scale. Successful exploitation can let an attacker run their own code on an unpatched web server.
Which PHP versions fix CVE-2026-109618?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and newer releases. PHP 8.1 and older receive no fix.
Does a WordPress security plugin or firewall plugin protect me?
Not reliably. The flaw is in PHP itself, and on Apache mod_php the demonstrated exploit works with a single request before WordPress or its plugins run. Updating PHP is the fix. A network-level web application firewall reduces risk while you work on it.
Should I take my website offline?
Cybersecurity authorities in the US, Europe and the UK advised organizations that could not patch to consider taking PHP sites offline temporarily. If you can't update or upgrade quickly, put the site behind a web application firewall at minimum, and get it fixed as soon as possible.
Need it done for you?
Patch in 24h ($249), staging-first upgrade (from $890, no fix, no fee), or a PHP-free static rebuild (from $490).
Request received
We'll email your PHP status report within a few hours. Check your inbox (and spam folder) for a message from hello@legacypatch.com.
Sources
- The Register — PHP devs publish critical bug fix (Oct 21, 2026)
- The Record — Hundreds of websites taken offline over two PHP vulnerabilities
- Krebs on Security — Widespread PHP flaw may cause many site outages
- NBC News — Critical vulnerabilities in PHP spark rush to update systems
- Official advisories: php.net
LegacyPatch is an independent service provider and is not affiliated with The PHP Group. This page is general information, not a guarantee that any specific site is safe.