October 2026 PHP Security Vulnerabilities: What Website Owners Need to Know

Understand the advisory and your next steps

On October 21, 2026, PHP published security releases addressing CVE-2026-109618 and CVE-2026-109619. CERT-EU describes critical vulnerabilities that can allow unauthenticated remote code execution. That means an attacker may be able to run code on an affected server without first signing in. Whether a particular website is exposed depends on its runtime, configuration and the vendor's remediation guidance; a public URL scan cannot establish that.

Two issues, in plain English

CVE-2026-109618 involves memory corruption associated with an out-of-memory condition. Running out of memory should fail safely; corruption can instead make program behavior unsafe. CVE-2026-109619 involves stale global state: information retained in the runtime is not handled safely in the affected circumstances. These are runtime problems, not evidence that every PHP application or WordPress installation has been compromised.

What to ask your host

Confirm the PHP version serving the live application, including background workers and command-line tasks. Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Have your hosting provider or administrator apply the relevant update, restart affected processes as appropriate, verify the active version and test important website functions. Unsupported branches may require vendor-supported backports or an upgrade; do not assume an old version is protected without vendor confirmation.

WordPress's October 21 announcement, “Critical PHP Security Release,” explains that PHP should be updated; a WordPress release is not required for this runtime fix. Continue normal WordPress, theme and plugin maintenance separately.

Review hosting protections and responsibilities

Web application firewall protections may help mitigate certain attacks, but are not a replacement for patching. Already running a PHP website? Apply the relevant security updates immediately. If compromise is suspected, preserve relevant evidence and involve your host or incident-response specialist.

Review who owns runtime updates, which dependencies your business needs and whether modernization would simplify maintenance. If you want to move quickly, share your website and essential features for a hands-on migration review. Ongoing maintenance responsibilities are agreed as part of the project.

Sources: PHP official advisory (https://www.php.net/archive/2026.php#2026-10-21-5), CERT-EU advisory 2026-018 (https://cert.europa.eu/publications/security-advisories/2026-018), and WordPress (https://wordpress.org/news/2026/10/critical-php-security-release/), all dated October 21, 2026.

Plan your next step

Request a personalized migration assessment at /start. We will review your existing website and requirements before proposing scope, pricing or timing.