{"id":3409,"date":"2026-10-21T19:30:00","date_gmt":"2026-10-21T17:30:00","guid":{"rendered":"https:\/\/pletzenauer.com\/2026\/10\/21\/php-security-vulnerability-october-2026\/"},"modified":"2026-10-22T17:49:12","modified_gmt":"2026-10-22T15:49:12","slug":"php-security-vulnerability-october-2026","status":"publish","type":"post","link":"https:\/\/pletzenauer.com\/en\/2026\/10\/21\/php-security-vulnerability-october-2026\/","title":{"rendered":"Critical PHP vulnerabilities: why you should update your website today"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>On October 21, 2026, the PHP team released emergency updates for two critical security flaws. Practically every website running on PHP is affected, including every WordPress site. Here&#8217;s what happened and what you should do today.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On October 21, 2026, the PHP security team shipped unscheduled updates fixing two flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 (CVSS 4.0), which means critical.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Both allow remote code execution: an attacker can send a crafted request and run their own code on your server, with no login required.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618<\/strong> is about memory handling. If PHP runs out of memory mid-request, partly initialized data can later be treated as valid.<\/li>\n\n\n<li><strong>CVE-2026-109619<\/strong> is about state that outlives a request. Data from one request can still be used by the next request on the same worker after it was freed.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">According to the PHP team, every PHP installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with Apache and mod_php, where a working exploit has been demonstrated that triggers before any of your site&#8217;s code runs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Am I affected?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your site runs on WordPress, WooCommerce, Shopware, TYPO3, Joomla or any other PHP system: yes, unless your server has already been updated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These versions (or newer) are safe:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>PHP branch<\/th><th>Safe version<\/th><\/tr><\/thead><tbody><tr><td>8.5<\/td><td>8.5.12<\/td><\/tr><tr><td>8.4<\/td><td>8.4.27<\/td><\/tr><tr><td>8.3<\/td><td>8.3.36<\/td><\/tr><tr><td>8.2<\/td><td>8.2.35<\/td><\/tr><tr><td>8.1 and older<\/td><td>no official updates anymore<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For PHP 7.4, 8.0 and 8.1 there are only minimal patches for people who compile PHP themselves. For a regular website, that means if you&#8217;re still on one of these, now is the time to move to a current version.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do now<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Check your PHP version.<\/strong> In WordPress under <em>Tools \u2192 Site Health \u2192 Info \u2192 Server<\/em>, in your hosting dashboard, or with <code>php -v<\/code> on the server.<\/li>\n\n\n<li><strong>Compare it with the table above.<\/strong> If your version is lower, your site is vulnerable.<\/li>\n\n\n<li><strong>Update, or ask your host.<\/strong> On shared hosting, the provider usually applies the update. Ask them today whether it&#8217;s done. On your own server, update the packages from your distribution&#8217;s repositories.<\/li>\n\n\n<li><strong>Restart PHP.<\/strong> Restart PHP-FPM or Apache after updating, otherwise the old code keeps running.<\/li>\n\n\n<li><strong>Retire old PHP versions.<\/strong> If you&#8217;re on PHP 8.1 or older, plan the move to 8.3 or 8.4 now. Check plugin and theme compatibility first and take a backup.<\/li>\n\n\n<li><strong>Test your site afterwards.<\/strong> Click through the homepage, forms, login and, if you have one, the shop checkout.<\/li>\n\n\n<li><strong>Look for warning signs.<\/strong> Unknown admin accounts, new files in the uploads folder or odd entries in the server logs. When in doubt, have it checked.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Not sure where to find your PHP version? This short video shows you the way:<\/p>\n\n\n\n<figure class=\"wp-block-video\"><video height=\"720\" style=\"aspect-ratio: 1280 \/ 720;\" width=\"1280\" controls src=\"https:\/\/pletzenauer.com\/wp-content\/uploads\/2026\/10\/wordpress-php-version-tutorial.mp4?v=2\"><\/video><figcaption class=\"wp-element-caption\">Tools \u2192 Site Health \u2192 Info \u2192 Server \u2192 PHP version<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">If you can&#8217;t update right away<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP team lists stopgap measures but is clear that they reduce risk without making an installation safe. Updating is the only complete fix.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set <code>session.upload_progress.enabled = 0<\/code> in <code>php.ini<\/code> or the FPM pool config and restart all PHP workers.<\/li>\n\n\n<li>Limit request size: <code>post_max_size = 8M<\/code> (no file uploads) or <code>32M<\/code> (with uploads), with <code>upload_max_filesize<\/code> below it.<\/li>\n\n\n<li>On PHP 8.5, also set <code>fatal_error_backtraces = 0<\/code>.<\/li>\n\n\n<li>More measures, such as the memory limit settings, are in the official advisory. Only someone who knows the server should change these.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">My advice<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Don&#8217;t wait. Once details of a critical flaw are public, automated attacks usually follow quickly, and bots don&#8217;t care how big your website is. Check your PHP version today, get confirmation from your host, and plan the upgrade if you&#8217;re on an old version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re not sure whether your site is affected, or you&#8217;d rather not do the update yourself, get in touch. I&#8217;ll check your setup and apply the update properly, with a backup first and a test afterwards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pletzenauer.com\/en\/book-a-call\/\">Book a call<\/a> \u00b7 WhatsApp\/Signal 0043 664 8740825<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Source: <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">official security advisory on php.net<\/a>, October 21, 2026. Last updated: October 21, 2026.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Two critical PHP flaws (CVSS 9.2) allow attacks without logging in. Which versions are safe and what to do right now.<\/p>\n","protected":false},"author":1,"featured_media":3413,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[147,18],"tags":[],"class_list":["post-3409","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-en","category-wordpress"],"_links":{"self":[{"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/posts\/3409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/comments?post=3409"}],"version-history":[{"count":3,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/posts\/3409\/revisions"}],"predecessor-version":[{"id":3428,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/posts\/3409\/revisions\/3428"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/media\/3413"}],"wp:attachment":[{"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/media?parent=3409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/categories?post=3409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pletzenauer.com\/en\/wp-json\/wp\/v2\/tags?post=3409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}