By Future Proof FoundersOctober 22, 20265 min read
If your website, store or app runs on PHP, and most WordPress sites do, update PHP today. Two newly disclosed flaws let an attacker run their own code on your server, in some setups without logging in and before your site's code even starts.
The PHP project released the fix on October 21, 2026. Palo Alto Networks' Unit 42 threat team says it has seen working proof-of-concept attacks, and at least one European government took its website offline as a precaution. This page tells you, in plain English, whether you are exposed and exactly what to do.
9.2
severity score out of 10 (CVSS 4.0), for both flaws
22.6M
exposed servers Unit 42 says may be vulnerable
OCT 21
fixed versions released
WHAT HAPPENED, IN PLAIN ENGLISH
PHP is the programming language behind a huge share of the web: WordPress, WooCommerce, many membership and course platforms, and a lot of older custom sites. The flaws are in PHP itself, so it does not matter how careful your own site or plugins are.
01
CVE-2026-109618: THE "OUT OF MEMORY" FLAW
An attacker sends a request that makes PHP run out of memory at just the wrong moment. PHP stops halfway through setting things up, then treats the half-finished data as real. That can be turned into running the attacker's code.
02
CVE-2026-109619: THE "LEFTOVER DATA" FLAW
After certain errors, PHP keeps pointing at memory it has already thrown away. The next visitor handled by the same server process can trip over that leftover data, and an attacker can use it to run their own code.
"Run their own code" is the worst category there is. It can mean stolen customer data, a hacked checkout page, spam sent from your server, or your site wiped.
ARE YOU AFFECTED?
According to the PHP project, every PHP installation that serves web pages is at risk. That includes the common setups: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates Apache with mod_php as the highest risk.
✕Probably affected: a WordPress or WooCommerce site, a self-hosted membership or course site, a VPS or shared hosting plan running PHP, any old PHP landing pages or tools you forgot about.
→Probably not affected: sites on Vercel, Netlify, Shopify, Squarespace, Wix or Webflow, and apps built in Node.js or Python. Those do not run PHP. (Our own sites run on Vercel without PHP.)
→Not sure? If you have ever logged into a "cPanel" or picked a "PHP version" in a hosting dashboard, assume yes and check.
WHAT TO DO TODAY
STEP 1
FIND YOUR PHP VERSION
In WordPress, go to Tools, then Site Health, then Info, then Server. On a hosting plan, look for "PHP version" in the dashboard. On your own server, run php -v.
STEP 2
UPDATE TO A FIXED VERSION
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On your own Linux server, install your distribution's security update and restart PHP and the web server. Distributions often patch without changing the main version number, so check their security notice rather than the number alone.
STEP 3
ON SHARED OR MANAGED HOSTING, ASK YOUR HOST
Send your host's support one line: "Have you applied the October 21 PHP security update for CVE-2026-109618 and CVE-2026-109619 to my server?" Get a yes in writing.
STEP 4
ON PHP 8.1 OR OLDER, PLAN THE MOVE
The PHP project no longer updates 8.1 and older. Some hosting vendors offer patched versions, so ask yours. Otherwise, this is the push to upgrade to a supported version.
LET YOUR AGENT CHECK FOR YOU
If you run your own server and use Claude Code, paste this in. It only looks and reports; it does not change anything until you say so.
Check this server for the October 2026 PHP flaws CVE-2026-109618 and CVE-2026-109619. Read-only first, change nothing yet.
1. Find every PHP version installed and which one each website uses (PHP-FPM pools, Apache mod_php, php-cgi, LiteSpeed, FrankenPHP).
2. Tell me if each one is patched. Fixed upstream versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. If PHP comes from my Linux distribution, check the distribution's security notice and the installed package version instead of the version number alone.
3. Report memory_limit, post_max_size, upload_max_filesize and session.upload_progress.enabled for each site.
4. Give me the exact update commands for this system, plus which services need a restart, and wait for my yes before running them.
Read what it reports, approve the update, and ask it to confirm the new version afterward. That is the whole loop: the agent does the checking, you make the call.
CAN'T UPDATE RIGHT NOW?
The PHP team is clear that only the update fully fixes this. If you are stuck for a few hours, they list settings that reduce the risk for the known attack paths. These are for whoever runs your server:
→Set session.upload_progress.enabled=0 in php.ini or the server config (not in .user.ini or ini_set), then restart every PHP worker.
→On PHP 8.5, set fatal_error_backtraces=0 and restart.
→Keep post_max_size low: 8M if the site takes no uploads, 32M if it does, with upload_max_filesize below it.
→The PHP advisory also covers memory_limit and container limits, with caveats. Read it before touching those.
Then update as soon as you can.
SOURCES
Everything above comes from two places. Read them for the full technical detail:
Yes, if your server's PHP is not patched. The flaw is in PHP, not WordPress, so updating WordPress or your plugins does not fix it. The server's PHP has to be updated.
Which PHP versions are fixed?+
8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions ship their own patched packages, which may keep an older version number, so check their security notice.
My site is on Vercel, Netlify, Shopify or Squarespace. Am I affected?+
Not by this flaw, unless something else you run uses PHP. Check any tools you host yourself, such as a WordPress blog or an old landing page server.
Build with agents, safely
LEARN THE TRUTH. BECOME FUTURE PROOF.
Checking servers, reading advisories and applying updates is exactly the kind of work an agent does well, with you approving every change. We show how, live, at the Future Proof seminar.