PHP needs an update this week.
On 21 October 2026 PHP published fixes for two critical flaws. On a server that is still on an older release, an unauthenticated web request can be enough to run code. Updating is the fix.
What PHP published
The advisory covers CVE-2026-109618 and CVE-2026-109619. The PHP project rates each at 9.2. They apply when PHP is serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP says the risk is highest for mod_php, and that a request can reach the flaw before the application itself runs. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also says there is no complete workaround. Anything short of the update is a stopgap, and the detail of those temporary steps belongs on PHP’s advisory, not in a paraphrase.
The counts do not agree
Public scans this week put the exposed population in the millions. One figure is about 22 million instances. Others count hosts, services or websites, then estimate. Those totals are not the same thing, and a server that still advertises PHP is not a confirmed break-in.
The useful number is the version answering requests for the site you are responsible for.
A site update is a different job
WordPress, Laravel, Magento and the rest sit on top of PHP. Updating the application, or a plugin, does not replace the engine underneath.
Ask whoever runs the server which PHP version is in production after PHP has been reloaded. Some Linux vendors ship this fix inside their own package and leave the version string looking old, so a banner on its own is not proof either way. Ask which package is installed.
PHP 8.1 and older are outside the updates the PHP project itself still ships. A distribution may carry a backport. If it does not, the durable move is a supported release. PHP 8.2 reaches end of life on 31 December 2026.
What to do this week
Name the live version with the host, the previous agency, or whoever last touched the server. Install the fixed release, or the vendor package that contains it. Reload PHP. Then check the site still answers, including the forms and uploads people actually use.
If nobody can name the version, that is the gap to close before the rest of the argument.
If the server is a mystery
Plenty of businesses inherited the site. The login is in an old email, and the PHP version is a guess. Bring the hosting login, or the name of the person who has it.
Three ways we can take it on
Maintenance, with this fix included
Packages start at £120 a month. If we look after the site, this update is part of that work. No extra cost for the PHP patch.
A one-time fix
We confirm the live version, apply the fixed release or your host’s package, reload PHP, and check the forms and uploads. Scope, price and date are agreed before we start.
A more secure codebase
If the site sits on a line PHP no longer maintains, or nobody can change it safely, the patch only covers this week. We can scope a replacement: the public site, the booking or enquiry path, and the code in your hands from day one.