Critical PHP security alert.
Patch now. Verify protection.

If your business runs a website, customer portal, online store or other application using PHP, treat this as a priority. Ask the team responsible for your hosting to confirm that the security fixes are installed and active.

What has been reported?

On 21 October 2026, the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619. Both concern PHP’s internal memory and request handling. In affected deployments, an attacker may be able to execute code remotely without logging in.

The PHP team identifies installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, CGI and other PHP integrations. It reports the highest risk for mod_php, where an attack can occur before application code runs. Read the official PHP advisory ↗

Why this matters to your business

A successful compromise could give an attacker access within the permissions available to the affected service. Depending on the environment, the consequences could include:

• Website or server compromise: unauthorised changes, malicious content or control of affected services.
• Data theft: exposure of customer information, application credentials or accessible business records.
• Disruption and extortion: interrupted services or a foothold for further attacks, potentially including ransomware.
• Recovery costs and loss of trust: investigation, restoration and time away from normal business.

These are possible consequences, not evidence that your business has been breached. A website working normally is also not proof that it is patched or uncompromised.

Does this affect WordPress or IIS?

This is a PHP issue, not a WordPress-only issue. Updating WordPress, plugins or themes does not replace patching the PHP runtime on the server. WordPress says no WordPress release is required specifically to fix these PHP vulnerabilities. You can usually check the PHP version under Tools → Site Health → Info → Server, then ask your host to verify the exact security package. WordPress guidance ↗

IIS is not a blanket exemption. An IIS website that runs PHP needs its PHP installation checked too. Applications that do not use PHP are not affected by these particular PHP flaws. Confirm the technology behind each application rather than relying on the web server’s name.

Immediate steps for website owners

1. Identify every PHP application. Include your main website, subdomains, customer portals, older sites and systems hosted by external suppliers.
2. Contact the responsible provider or developer. Ask them to check both CVE numbers and confirm the exact installed package, not just say that updates are enabled.
3. Apply the correct vendor patch. Use a supported release or a verified vendor security backport. Protect a recent backup and check compatibility when changing PHP branches.
4. Verify the running service. Updated files on disk are not enough if old workers remain active. The administrator must reload or restart affected services and test essential business functions.
5. Record the result. Keep the patch version, verification date and responsible person. Review suspicious activity with your security team if there are signs of compromise.

Which versions contain the fixes?

The PHP project’s fixed releases are shown below. Use these releases or a later security release in the same supported branch.

Hosting vendor packages may use different version numbers. A vendor can backport the fixes into an older branch. cPanel, for example, lists a fixed EasyApache PHP 7.4 package as 7.4.33-19. Your provider should check the package revision and security changelog. An older branch with these fixes still needs a plan to move to a supported PHP release. cPanel’s package and platform advisory ↗

Does a firewall protect us?

A firewall or web application firewall can reduce exposure and block some known attack patterns. It does not replace the underlying PHP update, and a successful security scan is not a substitute for verifying the installed patch. CloudLinux advises applying the fixed packages and refreshing the affected PHP processes even where WAF protection is in place. CloudLinux guidance ↗

Sautech can help you take action

Sautech can help identify PHP systems, check patch status, assist with remediation and assess your wider hosting and application exposure. Our vulnerability assessments can help prioritise other weaknesses alongside this urgent update.

Published 22 October 2026. Technical details are based on the linked vendor advisories, which may be updated. This notice covers the two PHP vulnerabilities above; it is not a certificate that an entire website or business environment is secure.