Last updated October 22, 2026. This situation is still developing, so we will update this post as hosts and vendors confirm their patches.
On October 21, 2026, the PHP project announced fixes for two critical security flaws. PHP is the programming language that runs WordPress, Drupal, Joomla, Magento and a huge share of the rest of the web. If your website runs on PHP, this affects you.
The short version: your hosting environment needs to be running a patched version of PHP, and it needs to happen soon.
What happened
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity.
Both can allow unauthenticated remote code execution. In plain terms, an attacker does not need a password or a login to run their own code on your server. One flaw involves how PHP behaves when it runs out of memory. The other involves leftover data from one web request being reused by a later one.
Attackers are not waiting. Amazon’s threat intelligence team recorded an exploitation attempt on October 17, four days before the public announcement, and other security firms have reported attempts since then.
Who is affected
Any server that uses PHP to serve web pages is at risk. That includes the common setups, such as PHP-FPM, Apache with mod_php, and LiteSpeed. Researchers have confirmed attacks against specific versions of WordPress, Drupal, Joomla and Magento.
The flaws sit in PHP itself, underneath your website software. Updating WordPress, your plugins or your theme will not fix this on its own. The PHP version on your server has to change.
What you need to do
- Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, and open the Server section. Your hosting control panel also shows it.
- Compare it to the patched versions. You are covered on 8.2.35 or newer, 8.3.36 or newer, 8.4.27 or newer, or 8.5.12 or newer.
- Find out who is responsible for patching. Managed hosts normally patch PHP for you, but ask for written confirmation. Shared hosts roll patches out on their own schedule. On a VPS or dedicated server, nobody patches it for you.
- Check older versions with extra care. PHP 8.1 and older no longer get official updates. Some hosting vendors backport the fix, and the PHP project has published limited source backports for 7.4, 8.0 and 8.1. Otherwise, the answer is to upgrade to a supported version.
- Back up before you change anything. Older themes and plugins can break on a newer PHP version, so test on a staging copy first if you can.
One caution: on some Linux servers the fix is installed without the version number changing. An older-looking version number does not always mean you are unpatched, and a newer one does not prove you are safe. This is why asking your host to confirm is worth the email.
How 101 Keys can help
If you manage your own hosting, or you are not sure what your host has done, we can take this off your plate. For clients who need it, we will:
- Identify the PHP version your site is running and whether it is exposed
- Update your hosting environment to a patched, supported PHP version
- Back up your site before the change
- Test your theme, plugins and key pages, and fix anything that breaks
- Check for signs of compromise
- Keep your site monitored and updated going forward through our website hosting and WordPress maintenance services
If you haven’t patched yet, don’t wait for a perfect plan. A patched site that needs a few cleanups is far better than an exposed one.
Frequently Asked Questions
No update to WordPress itself is needed for this issue. The vulnerabilities are in PHP, so the fix is a PHP update on your server. Keep WordPress, plugins and themes updated as usual, but do not treat that as protection here.
Not necessarily. It means your site is exposed. If you want to know whether anything has happened, we can review your site for signs of compromise.
Ask them which PHP version your site is running and whether all PHP processes were restarted after the update. A patch that is installed but not restarted does not protect you.
Plan an upgrade to a supported version, ideally 8.3 or 8.4, and test first. If you cannot upgrade immediately, ask your hosting vendor whether they have backported the fix. Our team can help with the compatibility testing.
Some firewalls, including Cloudflare, have added rules for the known attack methods. That is a useful extra layer, but it is only a stopgap measure. Updating PHP is the only complete fix.
Need help getting patched?
Not sure which PHP version your site runs, or who is supposed to be patching it? Call us at (289) 780-8880 or book a free consultation. We will check your hosting environment and tell you plainly where you stand.
For more on keeping your site protected, read our guide to protecting your WordPress website from hackers.
Sources: PHP.net security advisory, Tenable FAQ on CVE-2026-109618 and CVE-2026-109619, Help Net Security, Codeable