Originally published October 21; update checked October 24, 2026: The PHP security team has released urgent updates for two critical vulnerabilities that could allow unauthenticated remote code execution in vulnerable PHP installations. If your site uses PHP, ask your hosting provider or server administrator to confirm the exact runtime version and patch status now. The issue is in the PHP runtime; updating a WordPress theme or plugin alone does not patch the server's PHP installation.
Provider update checked October 24: PHP published an informational advisory on October 23 for CVE-2026-115560. PHP says the possible issue requires an unusual sequence involving session serialization settings and session upload progress, and plans a full advisory with its next regular bug-fix release. PHP characterizes the RCE vector as unlikely; the PHP project recommends disabling session.upload_progress.enabled until that release unless the setting is already disabled. If you do not administer the server, ask your host to confirm whether the relevant configuration applies. Bluehost says its protective measures cover this issue in managed hosting and that it will apply PHP's official fix when released; GoDaddy says its managed services are patched for the original PHP vulnerabilities, while self-managed VPS/server administrators must apply updates themselves. These are provider statements, not a check of any individual customer site. Read the PHP session-upload-progress advisory, Bluehost's current PHP update notice, and GoDaddy's status update.
What PHP released on October 21
The PHP team says the vulnerabilities are CVE-2026-109618 and CVE-2026-109619. One involves memory corruption during out-of-memory handling; the other involves stale request state being used across requests. Under the relevant conditions, these flaws can lead to remote code execution. The PHP project rates both critical, and its advisory identifies internet-facing PHP installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed as within scope. The demonstrated risk is highest for mod_php, but site owners should have their host determine applicability rather than assuming their particular setup is unaffected.
Which PHP versions contain the fixes?
For the currently supported PHP branches listed in the release notice, the fixed releases are:
- PHP 8.5: 8.5.12
- PHP 8.4: 8.4.27
- PHP 8.3: 8.3.36
- PHP 8.2: 8.2.35
Use the fixed release for the branch your application is actually running, or a vendor package that the hosting provider confirms includes the backported fixes. PHP 8.1 and older no longer receive routine updates from the PHP project; some Linux distributions and long-term-support vendors may provide backports. Do not infer patch status from a major version label alone. Ask the vendor to identify the package build and security fix.
A five-step response for a small-business website
1. Identify every environment
List the production website, staging copies, subdomains, control-panel applications, containers, and any older site still connected to the same hosting account. PHP can be selected separately by domain or directory on some hosts. A dashboard showing the desired version for one domain does not prove every application is using it.
2. Ask the host to patch the runtime
Contact hosting support or the server administrator. Ask which PHP runtime serves each public site, whether it is below the fixed release, which patched package will be installed, and when the change will take effect. On managed or shared hosting, the provider may control the runtime. On a self-managed server, have the administrator apply the vendor-supported update and restart or reload PHP workers so old processes do not continue serving requests.
3. Verify the live version and the site
After the update, confirm the active PHP version through the hosting panel or administrator, not just a local development terminal. Then test the public pages, WordPress login, contact forms, uploads, checkout or booking flows, scheduled tasks, and integrations that matter to the business. Review error logs for compatibility failures. Keep a known-good backup and a tested rollback plan, but do not roll back to a vulnerable runtime without a risk decision from the host.
4. Treat workarounds as temporary
The PHP advisories describe configuration steps that can reduce exposure to specific attack paths when an immediate update is impossible. Those steps are technical, environment-dependent, and explicitly not complete fixes. A web application firewall, a plugin update, disabling one feature, or changing an upload limit is not a substitute for a patched PHP release. Do not paste server configuration changes into a shared-hosting panel unless your provider or qualified administrator confirms they apply safely to your environment.
5. Check for signs of earlier compromise
Patching closes known vulnerable code paths; it does not establish whether an attacker reached the site before the update. Ask the host to preserve and review relevant web-server, PHP, application, authentication, and endpoint logs. Investigate unexpected administrator accounts, modified files, unfamiliar scheduled tasks, unexplained outbound connections, redirects, or changes to forms. If compromise is suspected, preserve evidence and involve a qualified incident-response professional before deleting files or rebuilding from an unverified backup.
What WordPress owners should know
WordPress runs on PHP, but PHP and WordPress are separate update layers. Update WordPress core, themes, and plugins as appropriate, while separately confirming the PHP runtime update with the host. A compatibility warning after a PHP upgrade should be investigated and corrected; it is not a reason to leave a critical runtime unpatched indefinitely. Our WordPress development and support work covers website maintenance and technical improvements, while the WordPress maintenance checklist explains the recurring site checks business owners can plan for.
Where to get authoritative guidance
Use the PHP team's October 21 security release and advisory as the source for fixed releases and technical mitigations. The individual CVE-2026-109618 advisory and CVE-2026-109619 advisory explain the vulnerabilities in detail. The UK National Cyber Security Centre alert and Canadian Centre for Cyber Security alert recommend identifying internet-facing systems and applying the updates promptly.
If you do not know which PHP version serves your business website, start with your host. For help checking the WordPress layer, backups, and essential customer paths after a runtime update, contact iDvlpr Marketing. We can help with website maintenance and verification; server-level PHP patching must be handled or confirmed by the hosting provider or your server administrator when they control that runtime.
This article is general website-maintenance information, not incident-response, legal, or hosting-provider advice. PHP advisories may be updated; consult the linked official sources for current technical instructions.