Critical PHP Security Flaws: What WordPress Website Owners Need to Do Now

Updated Thursday, 22 October 2026 (AEDT). Two newly disclosed critical security flaws in PHP, the server-side language used by WordPress and many other websites, could allow attackers to execute code remotely without an account or password. Both vulnerabilities carry a CVSS v4.0 rating of 9.2, and official security updates are available now. Website owners should check the PHP version running on their hosting server—updating WordPress itself is not enough.

Why are these PHP vulnerabilities serious?

The PHP project disclosed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026, together with patched versions. The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) published a critical alert for Australian organisations and website operators. PHP is the software that processes many WordPress requests, so an issue in its core runtime can affect otherwise up-to-date websites.

According to the PHP security team, CVE-2026-109618 concerns out-of-memory handling that can leave internal request data incompletely initialised; CVE-2026-109619 concerns request-owned state that may be reused after its memory is freed. Researchers have demonstrated unauthenticated remote code-execution paths. The PHP project says the risk is particularly high in certain Apache mod_php deployments, and advises all internet-facing PHP installations—including PHP-FPM, PHP-CGI, FrankenPHP and LiteSpeed—to update.

Important distinction: a serious flaw does not mean every WordPress website has been hacked. In its 21 October alert, the ACSC said it was not aware of active exploitation. However, the potential impact is severe and security researchers have demonstrated exploitability. Site owners should act promptly rather than waiting for an incident.

Which PHP versions should you install?

On 21 October, the PHP team announced these fixed releases:

• PHP 8.5: 8.5.12 or a later patched release on this branch.
• PHP 8.4: 8.4.27 or later.
• PHP 8.3: 8.3.36 or later.
• PHP 8.2: 8.2.35 or later. The PHP project says PHP 8.2 reaches end of life on 31 December 2026, so plan a longer-term upgrade.

PHP 8.1 and earlier no longer receive ordinary upstream security maintenance. Some Linux distributions and extended-support hosting providers may ship security backports, so ask your provider to confirm whether its exact installed build contains the fixes for both CVEs. A version number alone is not always proof of whether a vendor-maintained build is patched.

Five actions for WordPress website owners

1. Identify the PHP version on your website

In your WordPress dashboard, open Tools → Site Health → Info → Server and look for the PHP version. You can also consult cPanel, Plesk or the hosting provider’s management dashboard. The WordPress admin display may not show vendor patch backports, so your host should confirm the actual security status.

2. Ask the host to confirm fixes for both CVEs

Send this question to your hosting provider or web administrator: “Is our production PHP runtime patched against CVE-2026-109618 and CVE-2026-109619, and which exact PHP build is deployed?” Managed hosting providers may apply the fix centrally; self-managed server owners must check all relevant PHP workloads, workers and containers.

3. Back up and test before changing the runtime

Create a restorable backup of the website’s database and files. Where possible, test PHP compatibility on a staging site, especially if you rely on older plugins, payment gateways, booking forms or custom integrations. Coordinate a planned rollout for business-critical websites—but do not postpone security patching unnecessarily.

4. Apply the security patch and check key site functions

Use a supported PHP branch and a confirmed patched build. After the change, test the site’s public pages, contact forms, checkout, login, bookings, integrations and scheduled tasks. Keep WordPress core, themes and plugins updated as routine security practice, but remember that a plugin update does not repair a vulnerable PHP runtime.

5. Review logs and signs of compromise

Ask your host or security provider to check web-server, PHP, application and authentication logs for suspicious requests, unexpected processes, new administrator accounts or unexplained file changes. Preserve evidence and seek incident-response advice if anything looks unusual. In Australia, organisations can contact the ACSC on 1300 CYBER1 (1300 292 371).

Is a firewall enough until you can upgrade?

No. The PHP project says applying the security update is the only complete fix. Certain hardening measures may reduce exposure to specific attack paths, but they do not make an unpatched installation safe. If an affected internet-facing application cannot be patched promptly, discuss temporary isolation or restricted access with a qualified administrator.

What should non-technical business owners ask their developer?

1. What is our live site’s PHP version and exact patch level?
2. Have both October 2026 CVEs been addressed on our hosting infrastructure?
3. Do we have a current, tested backup and rollback plan?
4. Were all web-facing PHP workers and related services patched or restarted?
5. Has the site been tested and its security logs reviewed since the update?

The key takeaway is straightforward: check with your host, apply a verified patched PHP build promptly, and test your website afterwards. Avoid treating a green “WordPress is up to date” indicator as proof that the underlying PHP server is secure.

Image credit: Server-rack photograph by Kevin Ache / Unsplash. Illustrative image only; it does not show an actual cyberattack.

Official sources and further reading

• PHP project: official 21 October 2026 security advisory and fixed versions
• Australian Cyber Security Centre: critical vulnerabilities in PHP
• Google Cloud: technical overview and remediation guidance
• Canadian Centre for Cyber Security: affected versions and safeguards

Disclaimer: This NEXTNEWS article provides general information only, not tailored cybersecurity, legal or financial advice. Seek independent professional advice before changing production systems. Information reflects disclosures available as of 22 October 2026 and may be updated as authorities release further details.