Two critical PHP flaws mean most websites need an update, a bit like a recall notice for the engine under the bonnet
By Brett Gavaghan, Founder of Adaptd ·
PHP, the language behind WordPress and most of the web, released urgent security fixes on 21 October. Your website's plugins can't fix this one. The server has to be updated.
The short version
- PHP released fixes on 21 October for two critical flaws that let attackers run code on a web server without logging in.
- Every site running PHP is affected, including most WordPress sites, and the fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Ask your web host or developer to confirm your server's PHP has been updated, and plan an upgrade if it's on 8.1 or older.
Most small business websites run on PHP, even if nobody in the business has heard of it. On 21 October it got the software equivalent of a recall notice.
What are the new PHP vulnerabilities?
The new PHP vulnerabilities are two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a web server without logging in. The PHP team says all users should update immediately, and that updating is the only safe choice.
Wiz Research, which found the flaws, says PHP powers about 70% of websites, including WordPress, Joomla and Drupal, and that every PHP version from the last decade is affected by at least one of them. Wiz also says frontier AI models helped turn the decades-old weakness into a working attack.
Who needs to update, and how?
Anyone whose website runs on PHP needs the server updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The flaw sits underneath your website, so updating WordPress plugins won't fix it. Your host or developer has to update the server.
PHP 8.1 and older no longer get fixes from the PHP project, although some hosting and Linux vendors supply their own. Wiz says the worst case could expose passwords, login tokens and API keys held in the server's memory.
What should your business do about it?
Your business should email whoever hosts or looks after your website and ask one question: has our PHP been updated to a patched version? Good managed hosts will already be on it. If the answer is a long pause, that tells you something too.
My take: this is a two-minute email, and the people who skip it are the ones who find out the hard way. If your site is on an old PHP version, put the upgrade on the list now.
Nobody notices the engine until the car won't start.
Wondering what this means for your business?
That's exactly what the discovery call is for.