PHP Vulnerability October 2026: WordPress Advice | Webheads

Updated 21 October 2026

PHP has released urgent security updates fixing two critical vulnerabilities. Businesses running WordPress should confirm which PHP version serves their website and ensure the appropriate fix is applied promptly.

At Webheads, the rollout across our hosted websites is already underway. We began coordinating deployment with our hosting partner following the scheduled 3pm UK release. Our team is checking the running PHP versions and website functionality as updates are applied, and we will confirm completion for individual client sites once those checks are finished.

A website can be up to date in WordPress and still need a separate PHP update. Running a supported branch such as PHP 8.4 also does not, by itself, confirm that the latest security fixes have been installed.

What has been announced?

The PHP security team has released updates fixing two critical vulnerabilities, each rated 9.2 out of 10 under the CVSS severity system.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow an attacker to execute code without logging in. PHP identifies failures in memory handling and stale internal state as the underlying problems.

The fixes are now available. PHP recommends updating immediately to the appropriate fixed release for your branch:

Hosting providers and Linux distribution vendors may supply packages containing the same fixes under their own version numbers. Ask for explicit confirmation that both vulnerabilities are addressed.

Why this matters for WordPress

PHP runs on the hosting server and powers much of WordPress. Its maintenance is separate from updating the WordPress application, themes and plugins.

Your hosting provider determines which PHP packages are available. Depending on the hosting arrangement, the provider, your agency or your own technical team may install the update. The priority is to establish who will act and obtain confirmation when the fixed package is running.

Does PHP 8.4 need updating?

PHP 8.4 is a supported PHP branch, but a branch contains many individual patch releases. The full version number, including the final patch number, matters when checking whether a security fix is installed.

For websites running PHP 8.4, the fixed upstream release is 8.4.27. An installation running 8.4.26 or an earlier release in that branch needs updating unless its vendor has already applied both fixes to its own package.

PHP’s advisory covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identifies mod_php as the highest risk, with a demonstrated attack that can run before application code. Using PHP-FPM does not remove the need to patch.

What website owners should do

1. Record the full PHP version. In WordPress, go to Tools > Site Health > Info > Server and look for PHP version. Your host can confirm the package details.
2. Confirm responsibility. Ask who installs PHP security updates, whether your hosting package is affected and when the fixed package will be deployed.
3. Prepare for the update. Have a current backup and agree the essential checks with your technical team.
4. Apply the applicable fix promptly. Follow the published PHP advisory and your provider’s guidance. A broader upgrade to another PHP branch is a separate compatibility decision.
5. Verify completion. Ask your provider to confirm that the relevant PHP processes have restarted and that the patched version is serving website requests. Check forms, logins and other important functions. For an online shop, include checkout and payment testing.

WordPress’s PHP guidance explains where to check the version and how to coordinate an update with your host.

What if the patch cannot be applied immediately?

Escalate this to your hosting provider and agree an interim plan. PHP states that temporary measures reduce exposure to specific attack paths but do not make an installation safe. CERT-EU advises considering isolation of affected public applications when immediate patching is not feasible.

The appropriate response depends on confirmed exposure and the hosting environment. Make that decision with your technical provider, including consideration of the business impact of temporarily restricting access.

Does this mean a website has been hacked?

A vulnerability alert does not establish that a particular website has been compromised. Equally, a website appearing to work normally does not prove it is unaffected.

Ask your technical team to investigate unexpected file changes, unfamiliar administrator accounts or unusual activity in the available logs. Preserve relevant records if anything suspicious is found. Applying a patch and investigating a possible compromise are separate jobs.

What about older PHP versions?

PHP 8.1 and older are outside the PHP project’s supported branches. Organisations still using them need an upgrade plan, with compatibility checks for the website’s theme, plugins and custom integrations.

PHP has exceptionally provided minimal source backports for PHP 7.4, 8.0 and 8.1 to help vendors and people building from source. These do not restore normal support for those branches. Ask your vendor about a fixed package and plan migration to a supported branch.

How Webheads can help

Webheads can also assist businesses that need help with websites hosted elsewhere. We can establish the PHP version in use, review the hosting arrangement and coordinate any required updates with your provider. We can also check important website functions after the update and help investigate any concerns.

Our WordPress development and support services also cover ongoing maintenance, technical assistance and continued development through an agreed support arrangement.

Need help checking or updating your website? Contact Webheads with your website address and hosting details, and we can advise on the next steps.