On 21 October, the PHP team released security updates for two critical flaws in the PHP engine itself. The UK’s National Cyber Security Centre (NCSC) is urging organisations to act immediately, and NHS England has rated the threat as high.
PHP powers around 70% of websites, according to security firm Wiz, including WordPress, Drupal, and Joomla, so this could affect your site.
Here is what has happened, how to find out whether you are affected, and what to do about it. No jargon soup, I promise!
What has happened?
PHP has fixed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The NCSC scores both 9.2 out of 10 on the CVSS v4 severity scale. Both come down to how PHP behaves when a request runs out of memory: the clean-up can leave PHP’s internal state damaged, and a later request handled by the same worker can then trip over it.
Under certain conditions, an attacker with no login could use this to run commands on your web server, or read memory that may contain passwords, access tokens, and API keys.
Does this affect my website?
If your site runs on PHP, then almost certainly yes, until PHP on your server is updated. That includes every WordPress site.
The fixed versions are:
- PHP 8.5.12 or later
- PHP 8.4.27 or later
- PHP 8.3.36 or later
- PHP 8.2.35 or later
To see what your site is running, log in to WordPress and go to Tools, then Site Health, then the Info tab, and open the Server section. Some hosts apply the fix without changing the version number, so if in doubt, ask your host to confirm in writing that your site is patched.
What should you do?
- Find every place PHP is running. Staging sites, old microsites, anything reachable from the internet.
- Update PHP to a fixed version, or ask your host to do it. This is the only complete fix.
- On PHP 8.1 or older? Plan the move now, and test on a staging copy first.
- Look for signs of a break-in if the site was exposed.
How I can help
This is exactly the kind of job that falls through the cracks when nobody owns it. I am one person who builds, hosts, and looks after websites, so there is nobody to pass the problem on to.
