2026 PHP Security Vulnerabilities: Is Your Website Affected? + Free Risk Checklist
A website that still loads may still be running unpatched PHP. Start by identifying the live runtime and obtaining patch evidence, then agree an update and acceptance plan with your developer. You do not need to learn programming or attempt an exploit to begin. Updated: 31 October 2026.
What happened in October 2026?
On 21 October, PHP announced CVE-2026-109618 and CVE-2026-109619, with a risk of unauthenticated remote code execution. The advisory covers PHP installations serving web requests; it is not restricted to Windows or PHP-CGI. Do not confuse it with the separate Windows CGI vulnerability reported in 2024.
Check the full version and the patch source
The upstream releases fixing those two vulnerabilities are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These are the baseline fixes for that release, not permanent guarantees of safety. Check the current advisory when taking action. Linux distributions or long-term-support vendors may provide backported fixes: request the relevant vendor advisory and complete package version rather than judging the number alone.
Eight checks a website owner can organise
□ 1. Inventory the main site, subdomains, separate blogs, administration services, APIs and old campaign pages; assign an owner to each. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 2. Establish which services run PHP. A URL without .php does not establish that PHP is absent. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 3. Record the full PHP version used for live web requests, the host and the last update time. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 4. In WordPress, check Tools → Site Health → Info → Server. Ask the host if the dashboard is unavailable. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 5. Obtain the patch advisory, package identifier and confirmation that every relevant node and worker has the fix. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 6. Record file and database backup locations, dates and the restoration owner. A backup can also contain an existing compromise. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 7. Investigate unfamiliar administrators, redirects, suspicious files or hosting alerts through a separate incident process. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
□ 8. After remediation, test enquiries, login, booking or payment and retain results and open issues. Record: confirmed / action required / not applicable (reason), owner, date and evidence. If the evidence is unavailable, a check fails or the action requires server access, pass this item to the maintainer; suspected compromise goes to an incident-response professional.
Why an update still needs follow-up checks
PHP published additional Session upload progress guidance on 23 October and rebuilt Windows packages containing a Brotli fix on 26 October. Ask the developer to assess those notices against the actual environment. The Windows package -1 suffix identifies a dependency rebuild without changing the PHP runtime version, so a runtime screenshot alone may not prove that package is installed.
Free resource: PHP Website Risk Checklist
The editable Word checklist includes eight checks, a hosting-provider enquiry template and fields for results, owners, completion dates and evidence. Organise the facts before asking a developer to verify them. Resource links are provided by email. The request page requires your email, intended use and an initially unchecked subscription choice for occasional Allua marketing updates; you can unsubscribe at any time.
A useful message to your hosting provider
Please confirm whether [domain/service] is affected by CVE-2026-109618 and CVE-2026-109619. Provide its live web PHP version, patch package/advisory, deployment time and worker restart confirmation. Please also assess the 23 October Session notice and applicable Windows dependency updates. If work is outstanding, identify the risk, action plan and acceptance checks. Do not attach passwords or administrator keys.
Frequently asked questions
Q: Does HTTPS or Cloudflare remove the need to update?
A: Neither establishes that the PHP runtime is patched. Obtain host-side evidence.
Q: Does a clean scanner result prove the site was never compromised?
A: No. Version checks, scanners and log investigations have different coverage.
Q: Can configuration changes replace the update?
A: PHP states that interim mitigations do not completely resolve these vulnerabilities. The maintainer should assess any temporary measures.
Q: Should we immediately move to the newest major version?
A: Separate urgent patching from a wider version migration where appropriate. Choose a supported, compatible path and test it rather than combining an emergency fix with an untested rebuild.
Define the maintenance and acceptance scope
To discuss website maintenance needs with Allua, provide your website URL, hosting platform, current version and important customer journeys. Do not send account passwords through a public form. Enquiries: https://www.alluatech.com/contact-us
Official references
PHP security announcements: https://www.php.net/
Hosting-provider example (provider-reported patch deployment; confirm your own service): https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026
PHP 2026 release archive: https://www.php.net/archive/2026.php/
WordPress PHP update and version checks: https://wordpress.org/support/update-php/
Disclaimer
This article is based on general scenarios and information available as of the stated update date. It is for general information only and does not replace a professional assessment of your individual system. Hosting environments, PHP versions, configurations, plugins and integrations vary. Before updating software, changing settings, restoring a system or taking other action, consult a professional web developer or hosting provider to assess your specific circumstances and determine the appropriate action. If you suspect a compromise, also seek help from a professional experienced in cybersecurity incident response.
Comments