A Critical Flaw in PHP Itself Could Affect Your Website — Here’s What to Check This Week

The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026, patching two flaws tracked as CVE-2026-109618 and CVE-2026-109619, each rated a critical 9.2 on the CVSS v4 scale. The UK’s National Cyber Security Centre, in an alert published the same day, warned the flaws could let an attacker execute commands on any web server running PHP. Security firm Rapid7 reports that Cloudflare observed exploitation attempts the morning of 21 October, before the fix was even released — this is live, not theoretical.

Why “update your plugins” doesn’t cover this one

Most website security advice points at WordPress core, themes and plugins. This flaw sits a layer below all of that, in PHP itself — the server-side language that WordPress, and a great deal of other business software, is built on. Keeping WordPress and every plugin fully updated does not fix this; WordPress.org has confirmed no core update is required or planned for this issue. The fix has to happen at the server level, which for most businesses means it’s your hosting provider’s job, not yours directly — but it’s still worth knowing whether it’s been done.

Who actually needs to act

If your site runs on managed WordPress hosting, your host has very likely already patched the servers underneath you automatically — but it’s worth confirming via their status page rather than assuming. If you’re on ordinary shared hosting, the rollout is less consistent: some hosts had it patched within hours, others are still working through it. If anyone in your business manages their own server or VPS for a website or an internal tool, this is the urgent case — it needs a manual PHP update and a restart, and PHP versions 8.1 and older no longer receive routine fixes from the PHP project at all, which is itself a sign it’s time to move off them. Rapid7 and the PHP project both note that only updating to a fixed release closes the flaw properly; the available workarounds (such as disabling the session.upload_progress setting) only narrow the exposure.

Why this belongs on a compliance checklist too

An unpatched, internet-facing server running known-vulnerable software is exactly the kind of basic security hygiene gap that NIS2 asks in-scope organisations to manage proactively, and that’s hard to explain after the fact if a public-facing site handling customer data is later compromised through it. If a breach involving personal data results, the usual GDPR obligation to assess and, where required, notify the Data Protection Commission within 72 hours still applies regardless of whether the underlying flaw was in your own code or in software you depend on. We cover this kind of exposure as part of our cybersecurity & network security and SME IT support & management work. This is general information, not legal advice.

Three checks for this week

1. Ask whoever hosts or manages your website whether the 21 October PHP security release has been applied — most managed hosts already have, but don’t assume it for shared or self-managed hosting.
2. If you can check it yourself, look at your actual PHP version (in WordPress: Tools > Site Health > Info > Server). Anything on PHP 8.1 or older is overdue for an upgrade regardless of this specific flaw.
3. If your business runs any custom PHP application outside WordPress — a booking system, a customer portal, an internal tool — check that separately. It won’t show up in a WordPress health check.

If you’d rather this kind of server-level patching was tracked and handled as a matter of course, rather than noticed only when something like this makes headlines, that ongoing monitoring is part of our cybersecurity & network security work.

Facts current as of 22 October 2026, drawn from the PHP project’s own 21 October release, the UK NCSC advisory of the same day, and Rapid7’s published technical analysis, all linked above.