Critical PHP Vulnerabilities in 2026: Is Your Website at Risk?

Critical PHP security vulnerabilities disclosed in October 2026 have raised concerns for businesses running PHP-powered websites. The PHP project released security updates on October 21 for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, commonly referred to as PHP2Shell.

According to the official PHP security advisory, these vulnerabilities can potentially allow unauthenticated remote code execution. This means an attacker may be able to execute code on a vulnerable server without first logging in.

For businesses, a website security incident can lead to service disruption, unauthorised changes, sensitive information exposure and loss of customer trust.

The issue is relevant to businesses running PHP applications, including WordPress websites. However, having a vulnerable PHP version does not automatically mean a website has been hacked.

In this guide, we explain the recent PHP security vulnerabilities, the affected versions, how to check your website's PHP version and what steps you should take to improve website security.

What Happened in the October 2026 PHP Security Incident?

PHP is a server-side programming language used by websites, content management systems and web applications. WordPress, for example, relies on PHP to process requests and run much of its functionality.

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities.

The vulnerabilities are:

• CVE-2026-109618: A vulnerability involving out-of-memory error handling and improperly initialised internal request data.
• CVE-2026-109619: A vulnerability involving internal request state that can persist after the associated memory has been released.

Successful exploitation can potentially result in remote code execution. The official PHP advisory explains the technical details and the recommended security updates.

The PHP project published the following fixed releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Website owners should check their actual server environment and the latest guidance from their hosting provider before deciding whether their installation is protected.

Additional PHP Security Guidance Issued on October 23 (CVE-2026-115560)

On October 23, 2026, the PHP project also published an informational advisory regarding a third vulnerability, designated as CVE-2026-115560, involving session upload progress and a potential related remote code execution attack path under an unusual combination of application configuration and runtime behavior.

; Targeted partial mitigation for session upload progress advisory (CVE-2026-115560)
session.upload_progress.enabled = 0

The PHP session upload progress advisory recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release to address that specific risk. This issue affects applications where session.serialize_handler is set to php_binary or php_serialize in configuration and then switched to php at runtime before calling session_start().

Crucially, setting session.upload_progress.enabled=0 is a targeted partial mitigation only, not a replacement for upgrading PHP. While it reduces exposure to the session upload progress vector, it does not fix the underlying memory corruption or stale global state flaws in unpatched runtimes. Upgrading to one of the fixed PHP releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35) remains the primary and essential remediation step.

Why Do PHP Security Vulnerabilities Matter for Businesses?

A business website is often central to lead generation, online sales and customer communication. A serious vulnerability in the underlying software can create several risks.

1. Remote Code Execution

Remote code execution occurs when an attacker can cause a vulnerable system to execute code remotely.

Depending on the server configuration and permissions, successful exploitation may allow changes to website files, access to application resources or further compromise.

2. Sensitive Information Exposure

A compromised application may expose information accessible to its processes, including configuration files, database credentials, API keys or customer data.

The actual impact depends on the application's permissions and server isolation.

3. Website Disruption

Malicious activity can cause website errors, unwanted redirects, broken functionality or temporary outages.

For eCommerce businesses and service providers, this can interrupt sales and customer enquiries.

4. SEO and Reputation Damage

A compromised website may contain spam pages, malicious redirects or unauthorised scripts. These issues can affect user trust and search visibility.

Website owners should treat security maintenance as part of their broader website performance and search optimisation strategy.

For businesses planning improvements to their website's technical foundation, Webamazee's website development services include website builds, performance considerations and ongoing support options.

Which PHP Versions Need Security Updates?

The PHP project lists these fixed releases for the October 21 vulnerabilities.

Source: PHP's official 2026 release archive.

These are the fixed releases listed in the October 21 announcement. Linux distributions and hosting vendors may provide security patches through their own packages, so version numbers alone may not always tell the complete story.

PHP 8.2 reaches the end of its upstream support period on December 31, 2026. Businesses using this branch should plan an upgrade to a supported version and test application compatibility before deployment.

For the latest lifecycle information, consult the official PHP supported versions page.

Are WordPress Websites at Risk?

WordPress uses PHP to run its core software, themes and plugins. As a result, a WordPress website may be exposed when its underlying PHP runtime is vulnerable.

It is important to distinguish between a PHP runtime vulnerability and a WordPress plugin vulnerability.

• A PHP runtime vulnerability affects the software that executes PHP code.
• A WordPress vulnerability affects WordPress core, a theme or a plugin.

Updating plugins does not necessarily update the server's PHP runtime. Similarly, updating PHP does not automatically remove malicious code already present on a website.

The PHP advisory identifies multiple web-serving configurations that require attention, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

WordPress owners should check their PHP version, hosting configuration and available security updates rather than assuming that an up-to-date WordPress dashboard means the entire server is protected.

If your website requires improvements beyond routine updates, Webamazee's website redesign service can help modernise its structure and user experience while considering performance and SEO during the rebuild.

How to Check Your Website's PHP Version

You do not need to be a developer to begin checking your website's PHP version.

Option 1: Check WordPress Site Health

1. 1Log in to your WordPress administration dashboard.
2. 2Open Tools → Site Health.
3. 3Select the Info tab.
4. 4Expand the Server section.
5. 5Find the PHP version information.

This provides a useful starting point. If your hosting environment has multiple PHP handlers or applications, additional checks may be necessary.

Option 2: Check your hosting control panel

Many hosting providers offer PHP version information through cPanel or their own hosting dashboard.

Check the version assigned to your live domain. If you operate multiple websites or subdomains, verify each relevant environment separately.

Option 3: Ask your hosting provider

Ask your provider to confirm:

• The PHP version serving your website.
• Whether the relevant security patches have been applied.
• Which PHP handler and server configuration are in use.
• Whether other applications share the same runtime.
• Whether additional mitigation is required under the latest advisory.

Avoid publishing a diagnostic script such as phpinfo() on a live website just to check the version. Ask your hosting provider to use a controlled diagnostic method instead.

What Should You Do If Your Website Uses an Affected PHP Version?

If your website uses an affected version, take prompt action. However, avoid making untested production changes that could interrupt important business functions.

Step 1: Confirm the environment

Identify the PHP runtime serving the live website. Check production environments, subdomains and other applications where relevant.

Step 2: Apply the appropriate security update

Contact your hosting provider or technical administrator and arrange the relevant security update.

Test critical functionality where feasible, including login systems, contact forms, payment flows, integrations and scheduled tasks.

The PHP security advisory explains the fixed versions and available mitigations.

Step 3: Follow official mitigation guidance if immediate patching is impossible

If you cannot update immediately, follow the mitigation instructions relevant to your PHP version and configuration.

Temporary mitigations can reduce exposure to particular attack paths, but they do not provide the same protection as applying the required security update.

Do not apply unfamiliar PHP configuration changes blindly. Have a qualified administrator assess the impact on your application.

Step 4: Review logs and suspicious activity

Review available web server, PHP, application and hosting security logs for unusual requests or unexpected activity.

Look for suspicious file changes, unfamiliar administrator accounts, unexpected outbound connections and abnormal website behaviour.

The absence of obvious symptoms does not prove that a website is clean.

Step 5: Investigate possible compromise

If there is credible evidence of exploitation, updating PHP is only one part of recovery.

Depending on the incident, the response may involve:

For WordPress-specific recovery guidance, consult the official WordPress hacked-site recovery guide.

For wider cybersecurity guidance, the US Cybersecurity and Infrastructure Security Agency (CISA) has also published an alert about the critical PHP vulnerabilities.

Signs Your Website May Already Be Compromised

A vulnerable PHP version does not prove that a website has been hacked. However, the following indicators deserve investigation:

These signs can have other explanations, so investigate them rather than assuming that every anomaly is related to PHP2Shell.

If you suspect a compromise, avoid deleting unfamiliar files without understanding their role. Preserve relevant evidence where practical and seek qualified technical assistance when necessary.

How to Improve PHP and WordPress Website Security

A security update fixes a particular vulnerability, but ongoing protection requires a repeatable maintenance process.

Keep software supported and updated

Use a supported PHP version and apply security updates promptly. Keep WordPress core, themes, plugins and application dependencies updated as well.

Limit administrative access

Use strong, unique credentials and enable multifactor authentication for administrator accounts where available.

Give users and application processes only the permissions they need.

Maintain reliable backups

Back up website files and databases regularly. Protect backups from unauthorised access and test restoration procedures.

Monitor website activity

Review relevant security notifications, server logs and unusual website behaviour.

Protect configuration and credentials

Restrict access to configuration files and sensitive information. Avoid committing credentials to source control and rotate secrets that may have been exposed.

Review your hosting environment

Choose a hosting environment that provides supported software, timely updates, appropriate isolation and reliable backups.

A web application firewall may help filter certain malicious requests, but it cannot guarantee protection or replace necessary security updates.

Make security part of regular website maintenance

A practical maintenance process should include software updates, backup checks, access reviews, monitoring and periodic technical assessments.

For businesses looking to improve website crawlability, site architecture and technical health, Webamazee's technical SEO services can help address relevant technical website issues. Technical SEO is not a substitute for security patching, but it can form part of a broader website improvement plan.

Why Updating PHP Is Not Always Enough

Installing a security patch closes the relevant vulnerability in the updated runtime, but it does not automatically reverse changes caused by an earlier compromise.

If an attacker has already modified files, created unauthorised accounts, changed configuration or obtained credentials, those changes may remain after the PHP update.

Website owners should therefore ask two separate questions:

1. 1Has the vulnerability been addressed? Confirm that the correct security update is installed.
2. 2Has the website already been compromised? Investigate available evidence and take appropriate recovery action if needed.

Depending on the situation, recovery may involve file integrity checks, log analysis, credential rotation, a clean restoration and follow-up monitoring.

Do not assume that a current PHP version guarantees that every part of a website is secure.

Frequently Asked Questions

What is the PHP2Shell vulnerability?

PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. Successful exploitation can potentially allow unauthenticated remote code execution.

Is WordPress affected by the PHP vulnerabilities?

A WordPress website may be exposed if its underlying PHP runtime is vulnerable. Check the PHP version and hosting configuration and apply the appropriate security updates. This does not mean every WordPress website has been compromised.

Which PHP versions have security fixes?

The PHP project listed PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases for the October 21 vulnerabilities. Check the official PHP release archive for current guidance.

How can I check my website's PHP version?

WordPress users can check Tools → Site Health → Info → Server. Hosting dashboards may also show the version. Your hosting provider can confirm which runtime is actually serving requests.

Does updating PHP remove existing malware?

No. Updating PHP addresses the relevant software vulnerability, but it does not automatically remove malicious files, unauthorised accounts or exposed credentials. A suspected compromise requires investigation and appropriate recovery.

Can my hosting provider update PHP for me?

Many providers offer PHP version management or apply patches to managed hosting environments. Contact your provider to confirm the runtime, available security updates and any compatibility requirements.

Is a web application firewall enough to protect my website?

No. A firewall can reduce exposure to some malicious requests, but it is not a guaranteed fix. Apply the appropriate software updates and follow the official security guidance for your environment.

Final Thoughts: Protect Your Website Before a Vulnerability Becomes a Business Problem

The October 2026 PHP security releases highlight why website security depends on more than keeping plugins updated. The server software running underneath a website matters too.

Start by checking your PHP version, reviewing the official advisories and contacting your hosting provider if anything is unclear. Apply the appropriate updates, investigate credible signs of compromise and maintain reliable backups and access controls.

For businesses that depend on their websites to generate enquiries, support customers or process sales, these steps help reduce avoidable risks and protect customer trust.

Explore our website development services, review our SEO services, or visit the Webamazee homepage to discuss your requirements.

*Disclaimer: This article provides general information and is not a substitute for a security assessment or incident-response service. Always confirm technical recommendations against the latest official advisories and your hosting provider's guidance.*

Official Sources and Further Reading

• PHP security advisories and release archive
• PHP supported versions and lifecycle information
• PHP advisory: CVE-2026-109618
• PHP advisory: CVE-2026-109619
• CISA alert: Critical PHP vulnerabilities require immediate patching
• WordPress: Hacked website recovery guide

*Last reviewed: October 23, 2026. Review the latest advisories before publishing or updating this article.*