If your business runs a WordPress website, today’s PHP security announcement deserves immediate attention. Two critical vulnerabilities could allow attackers to run malicious code on affected servers without logging in. Security updates are now available.
Your next step is to have your hosting provider or website developer confirm that the PHP software running your website has received the fixes.
What happened?
On October 21, the PHP development team released emergency security updates addressing CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received a critical severity rating of 9.2 out of 10.
PHP is the software that processes WordPress behind the scenes. When someone visits your website, PHP helps generate pages and run features such as forms, customer accounts, and online shopping.
The newly disclosed flaws involve how PHP handles memory and information between requests. Under certain conditions, attackers can exploit these weaknesses to execute their own code with the permissions of the website’s server process. The precise exposure depends on the hosting configuration and application.
Why is this a problem for your business?
Successful exploitation could allow an attacker to change website files, access information available to the website, install malicious software, or interrupt service. The damage depends on the server’s permissions and the information it can access.
For a business, that could mean lost leads, unavailable booking forms, disrupted online sales, or customers encountering harmful content on your domain.
Your website may still look normal while running vulnerable software. Being affected does not automatically mean your website has already been hacked. It means the exposure needs to be addressed promptly.
Will updating WordPress fix it?
Updating WordPress alone does not install these PHP security fixes.
The problem exists in the underlying PHP runtime. Your hosting provider or server administrator needs to apply the appropriate PHP update. The PHP security announcement identifies multiple hosting environments as potentially affected, including PHP-FPM, Apache mod_php, and LiteSpeed.
WordPress, theme, and plugin updates remain part of good maintenance, but they are a separate responsibility.
What should website owners do now?
1. Ask your host to confirm the security patches
Send your hosting provider this question:
Has the PHP runtime serving my website been patched for CVE-2026-109618 and CVE-2026-109619? Please confirm the installed version or vendor security package.
The PHP project released these patched versions:
| PHP branch | Security release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Some hosting vendors apply security fixes to their existing packages, so the displayed version number may require additional verification. PHP 8.1 and older no longer receive regular updates from the PHP project; ask about vendor coverage or moving to a supported version.
2. Back up and test your website
Before making changes, create a backup of your website’s files and database. If you use a backup plugin such as UpdraftPlus, you can use it to create the backup, then download all backup components to your computer so you have a copy outside your hosting account.
If you suspect your website is already compromised, keep this backup separate from older backups that may contain a clean version of your website. Coordinate the backup with your hosting provider so it does not delay urgent patching.
After the PHP update, test the features your business depends on:
- Contact forms and email notifications
- Online checkout and payments
- Appointment booking
- Customer account access
- Administrative tools
Have your hosting provider confirm that the patched PHP runtime is active across every website and relevant server process.
3. Investigate suspicious activity separately
If you have noticed unexpected redirects, unfamiliar administrator accounts, or files that return after deletion, request a security investigation.
Installing a patch closes the addressed vulnerability. It does not remove malicious files or unauthorized access that may already exist.
4. Do not rely on a temporary workaround
The PHP team states that configuration changes can reduce certain attack paths but do not provide complete protection. Applying the security update is the complete remedy for these flaws.
Already using webpopular hosting?
If your website is hosted through hosting.webpopular.net, call 480-624-2500 for 24/7 hosting support.
Ask support to verify that your website’s PHP environment has been patched for CVE-2026-109618 and CVE-2026-109619 and help apply any required updates.
Afterward, test your website’s essential functions to confirm everything continues working as expected.
Need help getting it resolved?
You do not need to manage a server to take the right next step.
webpopular can help verify your website’s PHP environment, coordinate the required updates with your hosting provider, test essential website functions, and investigate signs of compromise. We’ll explain the findings and scope the work needed to address them.
Whether you use webpopular hosting or another provider, schedule an appointment with webpopular to discuss your website and hire our team to handle the remediation.
Bring your website address and hosting provider’s name so we can start with the right information.