October 2026 PHP vulnerability: affected versions and what to update

By Mouhamed BANKOLE, CEO at ITNET Technologies · Updated October 27, 2026 · Reading time: 8 min

On October 21, 2026, the PHP project released emergency security updates fixing two critical flaws that allow remote code execution without authentication (php.net announcement). CERT-FR, the French national cybersecurity agency's response team, issued an alert the same day and has since observed exploitation attempts (alert CERTFR-2026-ALE-014). PHP runs most WordPress, PrestaShop and Drupal sites: if you have a website, you are probably affected. Here is what is known about this PHP vulnerability, which versions are affected, how to check yours and what to do today.

In short

• Two critical PHP flaws allow remote code execution without authentication; they have been fixed since October 21, 2026.
• The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later; all versions 8.1 and older are affected.
• CERT-FR has observed exploitation attempts: updating is urgent.
• On shared hosting, the host updates PHP; on a VPS or a dedicated server, it is up to you.
• Until you can update, CERT-FR lists temporary measures, such as disabling a PHP option and filtering certain requests with a web application firewall.

Contents

1. What happened with PHP in October 2026?
2. Which PHP versions are affected?
3. What does this change for your website?
4. How do you find your PHP version?
5. What should you do today?
6. What if you cannot update right away?
7. Shared hosting or VPS: who has to update?
8. What if your PHP version is no longer supported?
9. How do you avoid being caught out by the next flaw?

What happened with PHP in October 2026?

The PHP project announced a critical security release on October 20, 2026, published the next day, fixing two flaws rated 9.2 out of 10 on the CVSS v4.0 scale (php.net announcement). The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 (php.net).

What is established, according to official sources:

• both flaws allow remote code execution without authentication (php.net);
• CERT-FR published alert CERTFR-2026-ALE-014 on October 21, 2026 and updated it on October 26 (CERT-FR);
• CERT-FR has observed exploitation attempts against both flaws and reports that public proofs of concept exist (CERT-FR);
• a third flaw, CVE-2026-115560, was announced on October 23; it only applies to a combination of settings the vendor considers unlikely, and no exploitation has been reported (CERT-FR).

What is announced: the PHP project will publish the full advisory for CVE-2026-115560 with the next bugfix release (php.net).

Which PHP versions are affected?

Every PHP version older than the October 21, 2026 fixes is affected, including the 5, 7, 8.0 and 8.1 branches, which no longer receive official updates (CERT-FR alert).

Sources: alert CERTFR-2026-ALE-014 for the affected versions, php.net announcements for the fixed versions and the end of life of the 8.2 branch.

For the 7.4, 8.0 and 8.1 branches, the PHP project says it no longer publishes releases, but it provides minimal patches in its source code (php.net): they are meant for teams able to recompile PHP themselves.

What does this change for your website?

If your site runs on an unpatched PHP version, an attacker could potentially take control of the server without any credentials, which is why CERT-FR flags it as urgent.

The concrete risks of a takeover:

• malicious code installed on your site (redirects, phishing pages, crypto miners);
• data theft: customer accounts, orders, forms, configuration files;
• your server used for further attacks, with a risk of your domain being blacklisted;
• damage to your search rankings if Google detects a compromised site.

Analysis: CERT-FR notes that the observed attempts target "specific PHP deployments" (CERT-FR). Not every site is equally exposed, but since this is hard to check yourself, updating is the only reasonable course.

How do you find your PHP version?

The easiest way is to look in your hosting control panel or, for a WordPress site, in the "Site Health" tool.

Four methods, from simplest to most technical:

1. the hosting control panel: the PHP version is shown in the PHP or website section;
2. WordPress: "Tools" menu, then "Site Health", "Info" tab, "Server" section;
3. a temporary file containing phpinfo() placed on the site, to be deleted right after reading (it exposes sensitive information);
4. on the command line on a VPS: php -v; if you use PHP-FPM, also check the version used by the web service, which can differ.

Note the full number (for example 8.3.36, not just 8.3): that is what tells you whether the fix is installed.

What should you do today?

Check your PHP version, update to a fixed version, then make sure your site works and that no suspicious file has appeared.

The steps:

1. take a full backup of the site (files and database);
2. move to a fixed version of your branch (8.5.12, 8.4.27, 8.3.36 or 8.2.35 at least);
3. update your CMS and its plugins at the same time, to avoid incompatibilities;
4. test the key pages: home page, forms, cart, customer area;
5. check the logs and recent files for PHP files you did not create;
6. change admin passwords if you notice anything unusual.

Pro tip: run the update on a copy of the site (staging environment) when possible, then apply it to production. A minor version bump (8.3.x to 8.3.36) rarely causes problems; a branch change (8.1 to 8.3) needs more testing.

For WordPress sites, our WordPress hosting guide explains how to choose and maintain your PHP version.

What if you cannot update right away?

CERT-FR lists temporary measures, which it states it has not validated: they reduce the risk but do not replace the update (CERT-FR).

The measures cited by CERT-FR:

• disable the session.upload_progress option in the PHP configuration; it only mitigates one of the two flaws (CERT-FR);
• filter certain file upload requests with a web application firewall (WAF), or monitor them if blocking is not possible (CERT-FR);
• isolate the affected servers until you can move to a fixed version.

These settings can break some site features (upload progress bars, upload forms): test them before leaving them in place.

Shared hosting or VPS: who has to update?

On shared hosting, the host installs the fixed PHP versions; on an unmanaged VPS or dedicated server, you do.

What this means:

• shared hosting: check that the fixed version is available and that your site actually uses it, since many control panels let you pick the version per site;
• VPS or dedicated server: update the system's PHP packages, restart PHP-FPM and the web server, then check the version actually served;
• managed server: ask your provider when the fix will be applied.

At Wayhost, the web hosting offer lets you choose your PHP version from the control panel and includes a web application firewall whose rules are updated continuously (observed on October 27, 2026 on the web hosting page). On a VPS or a dedicated server, system updates remain your responsibility; our guide What is a VPS? explains how responsibilities are shared.

What if your PHP version is no longer supported?

If your site runs PHP 8.1 or older, no official fixed release exists: you need to move to a supported branch (php.net).

To prepare the migration:

• list what depends on PHP: CMS, theme, plugins, custom code;
• check compatibility of each with PHP 8.3 or 8.4 with their vendors;
• test on a copy of the site before switching;
• plan for 8.3 or later: the 8.2 branch reaches end of life on December 31, 2026 (php.net).

How do you avoid being caught out by the next flaw?

By staying on a supported branch, applying minor updates as soon as they are released and following official alerts.

Good habits:

• subscribe to CERT-FR alerts and php.net announcements;
• automate minor PHP updates on your servers where possible;
• keep tested backups, so you can restore a clean site quickly;
• keep an inventory of your sites and servers with their PHP version.

Frequently asked questions

What is the October 2026 PHP vulnerability?

It consists of two critical flaws, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on October 21, 2026. They allow remote code execution without authentication. CERT-FR has observed exploitation attempts.

Is my WordPress site affected?

Yes, if its server runs a PHP version older than the fixed releases. WordPress runs on PHP, so the flaw affects the server hosting it, not WordPress itself. Check your version in "Site Health".

Which PHP versions should you install?

Versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later, fix the two critical flaws. The 8.1 and older branches no longer get official releases. In that case you need to move to a supported branch.

Does my host update PHP?

On shared hosting, yes, the host installs the fixed versions. Still check that your site actually uses the new version. On an unmanaged VPS or dedicated server, updating is your job.

Can you protect yourself without updating PHP?

CERT-FR lists temporary measures, such as disabling the upload progress option or filtering certain requests with a web application firewall. It states that it has not validated them. They reduce the risk but do not replace the update.

How can you tell if your site has been hacked?

Look for recent PHP files you did not create, unknown admin accounts and strange redirects. Also check the security alerts in Search Console. If in doubt, restore a clean backup and change every password.

Key takeaways

• Two critical PHP flaws allow a remote takeover and are being actively targeted.
• Versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later fix them.
• PHP 8.1 and older no longer get fixes: you need to migrate.
• On shared hosting, the host updates; on a VPS, you do.
• CERT-FR's temporary measures help, but do not replace the update.

For a site where you pick your PHP version in one click and which is protected by a web application firewall, explore Wayhost web hosting.

Article written by Mouhamed BANKOLE, CEO at ITNET Technologies.