The PHP project released a PHP security update on 21 October 2026 that fixes two critical flaws, either of which can let an attacker run code on a web server without logging in. If your website runs on PHP, which includes every WordPress site, ask whoever hosts it to confirm it is on 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer.
You do not need to understand the technical detail. You need an answer, in writing, from the person or company responsible for your website. This post tells you what to ask and what to do if the answer is not good.
What are the PHP vulnerabilities announced on 21 October?
PHP is the programming language that a large share of websites run on. WordPress, the most common website platform, is built on it. On 20 October the PHP project warned that an urgent release was coming. The fixes arrived on 21 October (CERT-EU, Security Advisory 2026-018, 23 October 2026).
The two flaws are CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. CERT-EU says both can allow unauthenticated remote code execution, meaning an attacker can run their own instructions on your server with no username or password. It adds that one request can trigger the attack before any of your website’s own code runs.
The BBC described the response as “a rare global cyber-security response” and reported websites being taken offline while organisations updated (BBC News, 22 and 23 October 2026).
Does this affect my WordPress website?
If your website runs on PHP and the PHP version is older than the fixed releases, yes, it may. CERT-EU lists PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35 as affected.
Security firm Searchlight Cyber says the flaw can be reached through widely used software including WordPress, Drupal, Joomla, phpMyAdmin, Nextcloud and Magento (Help Net Security, 22 October 2026). CERT-EU says technical details are public and proofs of concept have begun to circulate, which raises the chance that attackers are already trying it.
At the time of writing, 26 October, we have not seen evidence of widespread attacks on small business websites. Treat that as luck, not protection.
What should you do after the PHP security update?
- List what runs PHP. Your main website is the obvious one. Also check any customer portal, booking system, intranet or database tool built on PHP, and who looks after each.
- Ask your web host or developer, in writing, which PHP version each site runs and the date it was updated. If they cannot give you a version, that is itself a finding.
- Check the version is still supported. PHP 8.2 gets security fixes only until 31 December 2026, and older branches are no longer supported (PHP, Supported Versions, read 26 October 2026). WordPress recommends PHP 8.3 or greater, and says PHP 7.4 and older have reached end of life and may expose a site to security vulnerabilities (WordPress.org, Requirements).
- If you manage the server yourself, update now and restart the web service. This is not a job to leave for the next maintenance window.
- Look for signs of trouble. Unfamiliar administrator accounts, files you do not recognise, or a sudden alert from your host are all worth reporting straight away.
- Confirm you can restore the site. If the worst happened, you would want a clean copy. Our backup checks show how to test one.
One caution. Searchlight Cyber has released a free scanner for the flaws, and warns it works by deliberately making PHP run out of memory. It is a tool for IT staff, not something to point at a live site yourself.
What do we still not know?
A third PHP remote code execution flaw, CVE-2026-115560, was disclosed on 23 October. PHP considers it unlikely to matter, because it affects only web applications set up in an unusual way, and will not make an emergency release for it. CERT-EU says there is no detail yet and that PHP will publish a full advisory with its next release.
So expect another update. Ask your host to tell you when it lands, rather than waiting for the next headline.
Where does INDIGO IT fit?
INDIGO IT, a managed IT support and cyber security provider in Camberley, Surrey, has supported local businesses for more than 20 years. For many businesses the problem is not the patch but knowing who owns it. Your web host patches the server, your developer patches the site, and nobody has told you either.
If you are not sure who is responsible for your website, speak to Matt about your IT and we will help you work out the answer. If you want to check on your own first, our ten questions in the IT audit checklist include the question of which suppliers can reach your systems.
Frequently asked questions
What is the PHP security update released on 21 October 2026?
It is a set of fixed PHP versions, 8.5.12, 8.4.27, 8.3.36 and 8.2.35, that close two critical flaws rated 9.2 out of 10. Either flaw can let an attacker run code on a web server without logging in.
Does the PHP vulnerability affect WordPress?
WordPress is built on PHP, so a WordPress site on an unpatched PHP version may be exposed. Ask your host which PHP version your site runs and when it was last updated.
How do I check which PHP version my website uses?
In WordPress, go to Tools, then Site Health, then Info and open the Server section. If you cannot see it, ask your web host or developer for the version in writing.
Is PHP 8.2 still safe to use?
PHP 8.2 receives security fixes only until 31 December 2026, and 8.2.35 contains the 21 October fix. Plan a move to a newer branch soon. WordPress itself recommends PHP 8.3 or greater.
