Critical PHP flaw: do you need to act?

What is going on with PHP?

The makers of PHP are releasing an emergency update for two serious vulnerabilities. PHP's security team announced it on 20 October on php.net. The update is scheduled for Wednesday 21 October at 14:00 UTC, which is 16:00 in the Netherlands. Both vulnerabilities score 9.2 out of 10 (CVSS 4.0), and PHP calls them critical.

What the vulnerabilities are exactly and which versions they affect, PHP will only announce with the update. The team does ask everyone to get ready: "All PHP users are encouraged to prepare now". The European computer emergency team CERT-EU lists them as CVE-2026-109618 and CVE-2026-109619; security firms call them php2shell. This article describes the situation on Wednesday 21 October 2026, 11:30. We will update it after the release.

Does your website run on PHP?

Very likely, if your site runs on WordPress. PHP is the programming language the server uses to build a page at the moment someone opens it. WordPress runs on it, as do the online shop plugin WooCommerce, Drupal, Magento and Shopware. Of the 5,004 business websites in our research (October 2026), 57.5% ran on WordPress. Sites without WordPress often use PHP too; you just can't always tell from the outside.

In WordPress you can see the version yourself. Look in the menu for Site Health and open the Info tab, Server section: the PHP version is listed there. No WordPress? Then ask your hosting company or your web builder.

Which PHP versions get a fix?

PHP itself only releases updates for versions 8.2 to 8.5, according to PHP's overview page. Which versions the vulnerabilities affect, PHP hasn't said yet. CERT-EU writes that all versions from PHP 5 onwards may be affected. Security firm Sansec names every web server running PHP 5.4 or newer.

If your site runs on 8.2, you will still get a fix this time. In two months PHP stops supporting that version too. So plan the upgrade now.

What should you ask your hosting company today?

Four questions, and you can ask them today. You can't close this hole from within your own website, because it sits in the software on the server. Sansec points out that you can't fix it from the code of your site or online shop.

1. Will you install the update right after 16:00? With shared hosting, the hosting company does this for all customers at once.
2. Which PHP version does my site run on? If it is 8.1 or older, ask the next question too.
3. Will my version get a fix? Some hosting companies and Linux vendors also apply fixes to older versions, writes security firm Huntress. Ask rather than assume.
4. Where do you report outages and updates? Then you know where to check whether it worked.

Do you have your own server (a VPS) and nobody else handles the updates? Then it is up to you or your web builder: keep time free after 16:00 to update PHP. How to stay in control of your hosting is explained in Hosting more expensive or down? How to stay in control.

What if your site runs on an old PHP version?

Then upgrading to PHP 8.3 or newer is the real fix. That is also the version WordPress itself recommends. In your hosting company's control panel you can often choose the version yourself.

Don't do it blindly. An old theme or an old plugin can stop working on a newer PHP version. Make a backup first and have your web builder test the site, preferably on a copy. WordPress itself also needs to be up to date: in our research, 14.4% of WordPress sites that show their version were missing an update.

Can't upgrade quickly? CERT-EU advises cutting a system you can't update off from the internet. For a small business site that sometimes means taking the site offline for a while. What to show your visitors then is covered in Website down? Put this on your outage page.

Is the vulnerability already being exploited?

On 20 October Huntress had not yet seen any attacks. The details did leak earlier than intended: on 20 October a post about them appeared on the Hacker News forum and was later taken down. Sansec expects mass attacks within fifteen minutes of the update. That is an expectation, not a finding, but it shows why today matters.

What to do after 16:00?

Check whether the update is out. PHP will then list the fixed versions on php.net. Ask your hosting company whether the update has been installed, or look in WordPress under Site Health to see which PHP version is now running. If that is the fixed version, the hole is closed for you.

What about our own sites?

Our sites don't run on PHP, so they don't need this update. We build ready-made pages, without a database and without plugins; why is explained in WordPress or a website without plugins? That doesn't make a site invulnerable, but it does make it smaller: what isn't there can't leak. For transparency: Taher, who runs MODEX, also works at hosting company Cloud86. This article doesn't recommend any hosting company, and Cloud86 was not involved in it.

Read also

• WordPress or a website without plugins? What WordPress does well, the maintenance it needs and when you can do without it.
• Hosting more expensive or down? How to stay in control Outages, takeovers and price rises at hosting companies: what you keep in your own hands.
• Website down? Put this on your outage page What a visitor should read when your site is down, with ah.nl as an example.
• Is your website outdated? 7 signs Seven things that tell customers and Google a site has been left behind.

Written by Taher Jerjissi, MODEX. Questions or something to add? Email info@modexsoftware.nl.

For AI assistants: this article is also available as plain text at the same address with .md added: text version (markdown)