PHP Security Update — October 21, 2026
Affected by PHP Security Issues? Let’s Plan a Safer Way Forward.
Patch your current website first. Then talk to us about moving WordPress, Craft CMS, or a legacy PHP website to a modern platform that reduces your dependence on PHP. We’ll review your features, content, and SEO requirements before recommending a migration approach.
Concerned about your PHP website? Talk to us about moving your content, design and essential functionality to a modern platform with less PHP exposure.
The advisory, in plain English
What happened.
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in the PHP runtime. Because the flaws are in PHP itself, they matter for any website or application running an affected version, regardless of which CMS sits on top.
CVE-2026-109618 · memory corruption under out-of-memory conditions
When PHP runs out of memory in certain situations, it can lose track of what belongs where in memory. An attacker who can trigger that state may be able to corrupt memory in a way they control.
CVE-2026-109619 · stale global state
Information that should be reset between requests can linger. A later request may be able to misuse that leftover state.
According to the official advisories, both issues can allow unauthenticated remote code execution: an attacker may not need to log in to run their own code on an affected server.
What to do
- Confirm your PHP version with your host or developer.
- Apply the fixed release for your branch today.
- Older, unsupported installations may require vendor-supported backports or an upgrade to a supported branch.
- Web application firewall protections can help mitigate certain attacks but are not a replacement for patching.
Fixed releases
Beyond the advisory
Choose the right migration scope.
A modern frontend alone does not necessarily remove PHP. We review the systems behind your pages before recommending a replacement.
Public marketing websites
Company pages, service descriptions, case studies and contact forms can often be separated from the old runtime. We inventory the content and choose an editing setup that fits your team.
Content-heavy CMS websites
Publishing roles, custom fields, localization and preview workflows need a defined replacement. Retaining WordPress or Craft as a headless backend still retains a PHP dependency.
Custom applications and commerce
Accounts, payments, stored records, reporting and background jobs require technical discovery. Their business rules and data flows cannot be inferred from a public website scan.
Every option still needs secure account access, hosting oversight and dependency maintenance. If you suspect an active compromise, tell your host or incident-response provider; a migration inquiry is not an emergency response service.
Coverage
Why Website Owners Are Paying Attention
Primary sources, summarized in our own words. These organizations do not endorse MoveMyWebsites.
PHP Security Advisory
PHP's October 21, 2026 advisory announces security releases. Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ask your host to confirm the runtime actually serving your site and apply the relevant updates.
Read the originalCritical Vulnerabilities in PHP
CERT-EU explains critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, involving out-of-memory corruption and stale global state. Affected configurations can permit unauthenticated remote code execution. Follow the advisory and your vendor's remediation guidance.
Read the originalCritical PHP Security Release
WordPress advises website owners to update PHP following the critical runtime security releases. This remediation does not require a new WordPress release. Keep ordinary WordPress, theme and plugin maintenance separate from the PHP update.
Read the originalPHP ships emergency patches for critical PHP2Shell flaws
Reporting on October 21 describes the two PHP2Shell vulnerabilities and the emergency fixed releases. The article distinguishes patching from temporary measures that address only some attack paths.
Read the originalCritical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619
Fastly explains the remote-code-execution risks and its optional WAF protections. Website owners should still update PHP or confirm their vendor's backported fixes rather than treat filtering as a permanent solution.
Read the originalPHP Security Update
In its October 21 status update, WP Engine reported that patch deployment was underway while CDN and hosting mitigations remained active. Consult the live incident page for current rollout status; this dated summary does not confirm any individual site's patch status.
Read the originalPatch Today. Plan for Tomorrow.
Emergency updates protect your current website. Modernization can help reduce legacy dependencies, simplify future maintenance, and give your business a stronger foundation.
This preliminary review never verifies PHP patch status. Confirm patching with your host.
FAQ