Your website can look perfectly normal while the software behind it needs an urgent update. October's PHP alert is a reminder that checking the homepage alone cannot establish whether the site is protected.
What happened in October
On October 21, 2026, PHP released fixes for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They could allow code execution on vulnerable servers without signing in. The technical advisories describe problems with memory handling and state retained between requests.
PHP runs on the server and powers many content management systems and applications. The vulnerable component can sit underneath your website's design, theme and plugins.
Which versions contained the fixes
The releases fixing those two flaws were 8.2.35, 8.3.36, 8.4.27 and 8.5.12, depending on the branch. These identify the incident's patches; they are not a recommendation to remain on those versions indefinitely. Your provider should confirm the current compatible update. See the PHP project announcement.
Some providers incorporate patches into distribution packages without adopting PHP's release number. Ask for confirmation of the actual fixes as well as the version. CERT-EU also records an additional alert from October 23; later advisories belong in the review too.
What to ask your hosting provider
Request an answer for your specific domain: the PHP version it runs, whether both vulnerabilities have been patched, when that happened and whether subsequent alerts were reviewed. Establish who keeps it updated.
Could you confirm the PHP version used by my domain and whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied? Is any action outstanding following later alerts? Please confirm when it was updated and what I should test on the website.
In WordPress, the version appears under Tools → Site Health → Info → Server. The official WordPress notice explains that these are PHP vulnerabilities: updating a plugin or theme alone does not replace the server fix.
Update and check the whole journey
Arrange a recoverable backup and compatibility checks with the responsible person, without delaying an urgent fix. Then test access, forms, email receipt and any booking or payment functions the site actually uses. If immediate patching is impossible, the technical owner should assess the temporary isolation recommended by CERT-EU.
A patch fixes the vulnerability; it does not establish that no earlier intrusion occurred. If unfamiliar files, unknown users or unexplained changes appear, request an incident review and preserve logs.
Give ongoing maintenance an owner
Record who monitors server updates, who maintains the application and who tests the website afterwards. Keep the host's reply and the review date. Continue with the PHP security video and the website maintenance guide.