Security Advisory | 21 October 2026
Severity: Critical (CVSS v4.0: 9.2)
Status: Security updates expected — immediate preparation recommended
We are notifying all our clients about two critical security vulnerabilities announced by the PHP security team. These vulnerabilities are reported to potentially allow remote code execution (RCE) on affected PHP installations.
The vulnerabilities have been publicly associated with the identifiers CVE-2026-109618 and CVE-2026-109619.
PHP is widely used to power websites and web applications, including WordPress, Joomla, Drupal, Magento, WooCommerce, and many custom-built platforms.
As of the time of this advisory, PHP has scheduled a security release for 21 October 2026 at 14:00 UTC. Full technical details, affected versions, and fixed versions are expected to be published with the release. Customers should monitor the official PHP announcements and prepare to apply the appropriate security updates as soon as they become available.
Security reporting about possible early exploitation is mixed. Some researchers have reported indications of attack activity, while the Australian Cyber Security Centre has stated that it is not aware of confirmed active exploitation. Regardless, the critical severity of these vulnerabilities warrants urgent preparation and prompt remediation.
Who May Be Affected?
Security advisories indicate that PHP installations dating back to PHP 5 may be affected. However, the precise affected and fixed versions must be confirmed against the official PHP security release.
Potentially affected environments include:
- WordPress websites and WooCommerce stores.
- Joomla and Drupal websites.
- Magento and other PHP-based online stores.
- Laravel and other PHP application frameworks.
- Custom-built PHP websites and web applications.
- Hosting servers, containers, and other software products that include PHP.
Important: Running PHP does not mean your website has been compromised. It means you should identify your PHP environment and take the recommended precautions until the affected versions and fixes are confirmed.
What Is Remote Code Execution (RCE)?
Remote Code Execution is a type of security vulnerability that may allow an attacker to execute unauthorized code on a remote system.
If these vulnerabilities are successfully exploited, potential consequences could include:
- Unauthorized execution of code on an affected server.
- Modification or defacement of website files.
- Unauthorized access to data available to the compromised application.
- Installation of malicious scripts or backdoors.
- Disruption of website services.
- Further attempts to compromise accessible systems or resources.
The actual impact depends on the vulnerability details, server configuration, account permissions, and available security controls.
What Should You Do Now?
1. Identify Your PHP Version
Log in to your hosting control panel and locate the PHP version assigned to your website.
Depending on your hosting environment, this may be available under Select PHP Version, MultiPHP Manager, or PHP Configuration.
If you manage a VPS or dedicated server, you can check the PHP version using your server's management tools or the command line.
Record the version in use and compare it with the affected and fixed versions published in the official PHP security announcement.
If you cannot identify your PHP version, contact your hosting provider for assistance.
2. Prepare to Apply the Security Update
The PHP security team has scheduled a security release for 21 October 2026 at 14:00 UTC. Monitor the official announcement for confirmation that the updates are available.
Once a suitable patched version is released:
- Update PHP to an appropriate fixed version.
- If you use a managed hosting service, confirm that your provider has deployed the relevant security update.
- If you manage your own server, apply the appropriate updates through your operating system, package manager, or PHP distribution.
- Verify that the update has been applied successfully.
Do not assume that updating WordPress, a plugin, or a theme will resolve a vulnerability in the PHP runtime itself.
3. Review Available Security Logs
As a precaution, review relevant access logs, error logs, security alerts, and file changes for unusual activity.
Pay attention to unexpected administrator accounts, unfamiliar PHP files, suspicious redirects, unexplained changes to website content, and unusual processes.
These indicators are not proof of exploitation, and the absence of suspicious activity does not guarantee that a system is unaffected.
If you suspect unauthorized access, contact your hosting provider or security administrator and preserve relevant logs for investigation.
4. Keep a Recent Backup
Maintain a recent backup of your website files, databases, and relevant configuration files.
Where possible, retain a copy separate from the hosting account.
Backups can help with recovery, but they do not eliminate the vulnerability. If a compromise is suspected, investigate the incident before restoring a backup to avoid reintroducing malicious files.
What Are We Doing as Your Hosting Provider?
We are monitoring official PHP announcements and relevant security advisories to determine the appropriate response for our hosting environment.
Our response may include:
- Reviewing PHP versions and hosting environments under our management.
- Coordinating with relevant software and hosting vendors.
- Applying available security updates to provider-managed systems.
- Evaluating temporary protective measures where appropriate.
- Monitoring relevant security reports and suspicious activity.
- Providing further customer guidance as verified information becomes available.
Frequently Asked Questions
Has PHP confirmed that attacks are ongoing?
Reports about possible early exploitation have emerged, but public reporting is not fully consistent.
Is my website already compromised?
Not necessarily. Running a potentially vulnerable PHP version does not prove that your website has been attacked.
If you notice suspicious activity or believe unauthorized access may have occurred, contact your hosting provider and arrange an appropriate security investigation.
Do I need to update PHP immediately?
Identify your current PHP version now and prepare to update as soon as an appropriate security fix becomes available.
Verify the affected and fixed versions through the official PHP security announcement. If you cannot patch an affected, publicly accessible system promptly, discuss temporary access restrictions with your hosting provider.
Will updating PHP break my website?
PHP version changes can affect compatibility with older applications, themes, plugins, and custom code.
Where feasible, back up your website and test the update in a staging environment. Check essential website functionality after the change. If you cannot test safely, consult your developer or hosting provider.
Security remediation should remain a priority.
Does this affect WordPress websites?
WordPress runs on PHP, so the PHP runtime used by a WordPress website should be checked against the security advisory.
Updating WordPress core, themes, and plugins remains important, but those updates do not necessarily patch the underlying PHP runtime.
Can a security plugin protect my website?
A security plugin or web application firewall may provide additional protection, depending on the vulnerability and available rules. However, no such control should be assumed to fully mitigate these PHP vulnerabilities.
Apply the appropriate PHP security update as soon as it is available.
What if I am using an older PHP version?
Older PHP branches may no longer receive official security updates. Confirm the affected and fixed versions with the official advisory and consult your hosting provider about supported patched builds or migration options.
Moving to a supported PHP version may be necessary if your current version cannot be secured.
Official Security References
For verified updates, consult the following sources:
- PHP security announcements: https://www.php.net/archive/2026.php
This source should be checked for the latest information on affected versions, security patches, and recommended mitigation measures.
Need Assistance?
If you cannot identify your PHP version, need help applying a security update, or suspect that your website has been compromised, please contact our support team through your usual support channel.
When submitting a support request, include:
- Your website domain name.
- Your hosting plan or server type.
- Your current PHP version, if known.
- Any relevant error messages or suspicious activity.
Do not include passwords, private keys or other sensitive credentials in your ticket.
Final Recommendation
Identify your PHP environment now, monitor the official security release, and apply the appropriate security update as soon as it becomes available.
If your affected system cannot be patched promptly, consult your developer about temporary restrictions or isolation. Prompt action can help reduce exposure and protect your website, data and hosting environment.
This advisory is based on publicly available information as of 21 October 2026. The affected versions, fixed versions, and technical details should be verified against the official PHP security announcement before taking version-specific remediation steps.