PHP Just Patched Two Critical Website Flaws. Here's What to Check Now

What changed

On October 21, 2026, PHP, the programming language that runs a large share of the web including most WordPress sites and many online stores, shipped an urgent security release: versions 8.2.35, 8.3.36, 8.4.27, and 8.5.11 were superseded, with 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as the fixed builds. It fixes two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 on the common severity scale. Both allow what is called unauthenticated remote code execution, meaning an attacker can run their own code on your server without logging in first. PHP's advisory describes a working exploit that needs no login, with the highest risk for sites using a setup called mod_php, and security firms report that attacks are already happening. This is not routine maintenance. It is the serious end of the scale, and the fix is meant to be applied now.

The honest nuance

Most small business owners do not touch PHP directly, and that is the point. If your site runs on managed hosting, a website builder, or a hosted store platform, patching PHP is usually your provider's job, and many hosts applied this one within hours. The real question for you is whether your site is actually patched yet, and who is responsible. A fix only protects you once it is installed, and the version number is not always a clear signal: hosts often ship their own patched builds that keep a different version string, so the safe move is to ask rather than guess. One caution: older PHP (version 8.1 and earlier) did not get a normal update. The PHP team published source-level patches for 7.4, 8.0, and 8.1 to help people building from source, but if you are on one of those, you most likely need your host or vendor to apply a patched build, or an upgrade to a current version.

Why it matters for your business

When a critical flaw like this is public and already being exploited, automated attacks move fast. Cheap scanning tools sweep the web looking for sites that have not applied the fix yet, and they do not care how small you are. An unpatched server that handles customer details, payments, or logins is exactly the kind of soft target these sweeps are built to find. The window that matters is the days right after a release, which is why 'I will get to it later' is the wrong response here. The businesses that come through fine are the ones whose sites were patched quickly, usually because a host did it or because someone checked and confirmed it.

What to actually do

Today, ask whoever runs your website one plain question: are we on a fixed PHP version, 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or your host's own patched build, and has PHP been restarted since. If you are on managed hosting or a hosted platform, confirm the patch is applied rather than assuming it, given how serious this one is. If someone runs the site on a server you control, have them update and restart PHP now, and rebuild any container images. If your host cannot patch straight away, ask whether they have applied the interim step PHP suggested, turning off session upload progress, which lowers exposure but is only a partial stopgap, not a substitute for updating. If you are on PHP 8.1 or older, you are likely on an unsupported version, so ask about a backported patch and plan an upgrade. Then do the same check for any forgotten site or second domain you own. Do not wait for a convenient time.

From Kindloom Labs

If taking stock of the tools and sites your business runs feels overdue, the free Small Business AI Use Case Checklist is a simple way to get it all in one place.

Sources

• Today's PHP Security Release, and How We're Strengthening PHP Security (The PHP Foundation)
• Major security alert: PHP vulnerable to critical RCE, attacks ongoing (Patchstack)
• PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do (Codeable)