Short answer: if your website runs PHP, check the PHP version assigned to the live website in your hosting account. The PHP fixes released on 21 October 2026 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your site runs a different version, or an older patch number in one of those branches, ask your host to confirm it has installed the security fix. If your site does not run PHP at all, these two PHP flaws do not require a PHP update on that site.
This is a quick version check, not a scan of your website. No public checker can reliably tell you what runtime is installed behind every site, and a version hidden from visitors does not prove that it is patched.
What are the PHP vulnerabilities?
On 21 October, the PHP project published fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. The flaws affect the PHP runtime itself, the software that executes PHP applications. Under certain request and memory conditions, an attacker could potentially run code on a vulnerable server without logging in. The PHP project rates both issues 9.2 out of 10 under CVSS 4.0 and urges PHP users to update immediately. The risk is not limited to WordPress: it applies to web servers running PHP in configurations including PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed. Read the PHP security advisory.
That does not mean every PHP website has been hacked. It means the underlying runtime had a serious weakness and needs the fix. Updating WordPress, a plugin or a theme does not patch the PHP engine.
The simplest check: look in your hosting account
- Sign in to the account where your website is hosted.
- Open its PHP settings or version selector. In cPanel, this is often called MultiPHP Manager; other hosts use labels such as PHP Manager or PHP version.
- Choose the live domain and note the PHP version assigned to it.
- Compare that full version with the fixed release for the same branch in the table below.
If your site is WordPress, there is another easy place to look: in WordPress, open Tools → Site Health → Info → Server and find the PHP version. WordPress.org documents this path in its security update notice.
Use the host's settings as the source of truth. Running php -v on your own laptop only reports the PHP on that computer. Running it over SSH can also show the command-line version, which may be different from the PHP version serving website requests. If you have a managed host, ask support: “What PHP version is serving my live domain, and does it include fixes for CVE-2026-109618 and CVE-2026-109619?”
Which PHP versions include the fix?
| Your PHP branch | Fixed release | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update to 8.5.12 or a later security release in that branch. |
| 8.4 | 8.4.27 | Update to 8.4.27 or a later security release in that branch. |
| 8.3 | 8.3.36 | Update to 8.3.36 or a later security release in that branch. |
| 8.2 | 8.2.35 | Update to 8.2.35 or a later security release in that branch; plan a move to a newer supported branch because PHP 8.2 support ends on 31 December 2026. |
These are upstream PHP release numbers. Linux distributions and managed hosting providers may backport a security fix without changing the upstream version number shown in a panel. If your version appears older, do not guess: check the host or operating-system vendor's advisory for these two CVEs and ask for written confirmation that the active web runtime is patched. PHP 8.1 and older no longer receive normal PHP project security updates; some vendors may provide specific backported fixes. Check PHP's current support table.
It still says an old version. What now?
Contact your web host or server administrator today and ask them to install the security update for the PHP runtime serving your domain. If you use a hosting panel, select a supported fixed PHP release for the correct domain, apply the change, and follow the host's instructions for restarting PHP-FPM or the web server. Then revisit the panel or WordPress Site Health and confirm that the live site reports the patched version. Check every domain, staging site, container and background service that runs PHP; a site can have more than one PHP runtime.
If the update is not available in the panel, ask the host when it will be installed and whether a vendor backport is already applied. A web application firewall may reduce some requests, but the PHP project says temporary mitigations are incomplete. A plugin, theme update or WAF rule is not a replacement for patching the runtime.
If you manage the server yourself and cannot patch it promptly, restrict public access or take the internet-facing PHP service offline while you arrange the fix. The UK National Cyber Security Centre advises organizations to consider taking systems offline when immediate remediation is not feasible. If you suspect the server may already have been compromised, preserve relevant logs and get incident-response help before treating the version update as a complete recovery.
What if my website is built with .NET?
If the live website is genuinely a .NET application and PHP is not installed or used anywhere in its production environment, these specific PHP vulnerabilities do not apply to that site. You do not need to install or update PHP to address them. Continue applying security updates to .NET, the operating system, web server, dependencies and any CMS or services you actually use.
Check for mixed setups before closing the alert. A .NET website may share a server or account with a separate WordPress blog, PHP-based support tool, admin utility or container. If any public-facing service on the server runs PHP, check and patch that PHP runtime. The technology label on the homepage is not enough; the hosting configuration is what matters.
Quick decision
- PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later in the same branch): the upstream PHP release includes these fixes. Confirm that is the live web runtime and that your vendor has applied any required package update.
- Older PHP number: not confirmed safe. Update through your host or verify a vendor backport for both CVEs.
- PHP 8.1 or older: treat as urgent, ask the host for a supported patched runtime, and plan a PHP upgrade; upstream support has ended.
- No PHP anywhere in the production service: this PHP alert does not apply. Keep the stack you do run updated.
The quickest reliable answer is one message to your host: “Is the PHP runtime serving my live website patched for CVE-2026-109618 and CVE-2026-109619? Please confirm the active version or vendor backport.”
Cover image: AI-generated conceptual illustration of a server security update; it does not depict or verify a real website.
Sources
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP.net
- PHP Supported Versions — PHP.net
- Critical PHP Security Release — WordPress.org
- Critical security issue affecting PHP — UK National Cyber Security Centre
