UPDATE – 23 October 2026: The PHP security release is now available, and the two critical vulnerabilities have been confirmed as CVE-2026-109618 and CVE-2026-109619. The NCSC says the flaws can, under certain conditions, be exploited for unauthenticated remote code execution on systems running PHP.
The UK National Cyber Security Centre (NCSC) is urging organisations to take immediate action. PHP is widely used behind business websites, content-management systems and hosted applications, including WordPress, so this is relevant to organisations running internet-facing PHP systems.
PHP has released fixed versions for supported branches, including PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP project says there are no complete mitigations and that updating is the only safe choice.
Why is this PHP security update critical?
PHP is a server-side scripting language used to generate dynamic web pages and run application logic. It powers a large proportion of websites and is commonly used by platforms such as WordPress.
The two vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — were both rated CVSS v4.0 9.2. The NCSC says they can trigger out-of-memory conditions that lead to memory corruption and, under certain conditions, unauthenticated remote code execution.
That makes this more serious than a routine website patch. An attacker may be able to execute commands on a vulnerable web server without first signing in.
What should website owners check now?
The position is now clearer than it was when the warning was first issued: businesses should identify PHP systems and move them to a fixed release as quickly as possible.
- Identify every system using PHP, not just obviously old installations.
- Prioritise internet-facing websites and services because they are directly exposed to external traffic.
- Check the PHP version currently used by each site or server.
- Confirm who controls PHP updates — your hosting provider, website developer or internal IT team.
- Update to a fixed PHP release as soon as possible.
- Review logs and security monitoring for suspicious activity or evidence of compromise.
- Check third-party products and appliances that may bundle PHP internally.
Not sure whether your website is running a vulnerable PHP version?
KES can check your hosting environment, PHP version, WordPress installation and update path before a critical security issue turns into a website compromise.
Does this affect WordPress?
Potentially, yes — because WordPress itself runs on PHP.
The NCSC now says organisations using any version of PHP should identify their PHP installations and assess exposure to CVE-2026-109618 and CVE-2026-109619. That means website owners should not assume they are safe simply because WordPress core, plugins and themes are fully up to date.
WordPress updates and PHP updates are separate. A website can be running the latest version of WordPress while still using a PHP runtime that needs this security fix.
If you manage a WordPress website, check both the WordPress software and the PHP version provided by the hosting platform.
Which PHP versions are supported?
PHP currently lists versions 8.2, 8.3, 8.4 and 8.5 as supported branches. PHP 8.2 is in security-fixes-only support until the end of 2026, while newer branches retain longer support windows.
Older end-of-life PHP branches are a separate concern because they may no longer receive fixes at all. If a business site is still running an unsupported PHP release, the right response is usually to plan an upgrade rather than relying on a one-off patch.
Should you update PHP immediately?
Yes. PHP says there are no complete mitigations for these vulnerabilities and that updating is the only safe choice.
For supported branches, the fixed releases include:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Production websites still need a controlled update process because a PHP change can expose compatibility problems in old plugins, themes or custom code. The safest sequence is to verify a current backup, update PHP promptly, test the website afterwards and investigate any unusual behaviour.
If you cannot update immediately, follow the temporary mitigations published by the PHP Foundation. If neither patching nor mitigation is practical, the NCSC says you should consider taking the affected system offline until it can be secured.
What should businesses ask their hosting provider?
- Which PHP version is my website currently running?
- Is that version affected by the October 2026 critical vulnerabilities?
- Will the hosting platform apply the security release automatically?
- If not, when will the fixed PHP version be available?
- Will you test or monitor the website after the update?
- Are backups current if the update causes a compatibility problem?
For managed websites, the important thing is not simply whether an update exists but whether somebody is actively responsible for applying and verifying it.
Quick answers
What changed in today's PHP security update?
The two critical vulnerabilities are now confirmed as CVE-2026-109618 and CVE-2026-109619, and fixed PHP releases are available.
How serious are the PHP vulnerabilities?
Both were rated CVSS v4.0 9.2. The NCSC says they can, under certain conditions, lead to unauthenticated remote code execution.
Which PHP versions should be updated?
The NCSC says organisations using any version of PHP should identify their installations and update to the latest fixed version. Supported fixed releases include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Does this automatically mean my WordPress site has been compromised?
No. The warning means the underlying PHP runtime must be checked and updated. Website and server logs should also be reviewed for suspicious activity where exposure is possible.
Can I rely on a workaround instead of updating?
PHP says there are no complete mitigations and that updating is the only safe choice.
Sources
