Critical PHP vulnerability: the October 21 emergency update and your website
Your WordPress website, your WooCommerce store, your client portal: under the hood, nearly all of them run on PHP, the language that powers a large part of the web. On October 20, the PHP team warned administrators to get ready for an emergency update the next day, for two flaws deemed critical. Each PHP vulnerability is rated 9.2 out of 10.
Most small business owners never chose their PHP version, and that’s exactly the problem: someone else often has to apply the fix. Here’s what we know, who has to act, and the email to send today.
The PHP vulnerability in four dates
What php.net published on October 21
The php.net security advisory confirms two critical vulnerabilities that can allow unauthenticated remote code execution:
- CVE-2026-109618 (RCE via OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialized.
- CVE-2026-109619 (RCE via stale global state): request-owned internal state can survive after its memory has been freed, and a later request handled by the same worker may use it.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to php.net, every PHP installation serving web requests is at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed), with the highest risk on mod_php. Linux distributions and LTS vendors received the patches in advance, so check their updated packages.
PHP 7.4, 8.0 and 8.1 no longer get updates from the PHP project. Given the severity, the security team did provide minimal source backports, mainly for people who build PHP from source. php.net is clear that mitigations reduce some attack paths, but none replace updating. That’s the reference page for what to install; be wary of lists circulating elsewhere.
📏 9.2 or 10 out of 10: what’s the difference?
The PHP team rates each flaw 9.2; watchTowr’s researchers say 10. For a small business, the nuance hardly matters: both numbers mean “critical, fix without waiting”. The real signal is the leak: when details circulate before the fix, the time before the first attacks gets shorter. On October 20, watchTowr said it had seen no exploitation, but had reproduced one of the flaws.
Does your PHP version still get fixes?
PHP only fixes branches that are still supported. If your site runs on an older version, no official update will come, even for a critical flaw.
From riskiest to safest (according to php.net)
PHP 7.4, 8.0, 8.1 and olderEnd of life: no official fixed release, only minimal source backports. Replace, don’t just “watch”.PHP 8.2Fixed in 8.2.35, but security fixes until December 31, 2026 only: plan what comes next now.PHP 8.3Fixed in 8.3.36. Security fixes until December 31, 2027.PHP 8.4 and 8.5Fixed in 8.4.27 and 8.5.12. The newest branches, supported until 2028 and 2029.Many small business sites still run PHP 7.4: an old theme or plugin “didn’t work” on PHP 8, and the upgrade got pushed back. Some hosts maintain old versions themselves, but ask for it in writing rather than assuming.
Who has to apply the PHP vulnerability fix?
| Your website is… | Who installs the PHP fix | Your role |
|---|---|---|
| On shared hosting (cPanel, Plesk…) | The host updates PHP on its servers | Check the branch selected for your site (e.g. 7.4 or 8.3) and ask when the fix will be applied |
| On managed WordPress hosting | The host, usually automatically | Get written confirmation, especially if you asked for an older version |
| On a virtual private server (VPS) or dedicated server | You, or whoever manages the server | Schedule the update today, after a backup |
| At a web agency that “handles everything” | Depends on the contract | Ask who is responsible, in writing, before the end of the day |
| On a SaaS platform (Shopify, Wix, Squarespace…) | The platform | Nothing to do for PHP |
The email to send today
No technical knowledge needed. Copy, adapt and send it to your host or agency:
Why these questions
- 1The account number saves back-and-forth.
- 2“A recent version” isn’t an answer: you need the exact number.
- 3A specific date tells you whether the host takes it seriously.
- 4On an end-of-life version, there will be no official fix: you need to switch versions, with a backup first.
Five steps, in order
STEP 1
Find the version
In WordPress: Tools, Site Health, Info, Server.
STEP 2
Email the host
The email above, today.
STEP 3
Back up
Files and database, copy kept off the server.
STEP 4
Update
PHP, then WordPress, theme and plugins.
STEP 5
Test
Contact form, payment, login.
Once PHP is up to date, use the opportunity to clean house: unused plugins, old admin accounts, backups never tested. The Magento BlockStrap vulnerability showed how fast an online store becomes a target, and our 8 questions to ask your web host still apply.
At NeoTech, we manage WordPress sites and servers for small businesses: our website design service includes updates, and our server management covers VPSs. With our cybersecurity services, automated 24/7 monitoring with on-call technician response flags abnormal behaviour on your servers.
Book your free cyber check
Not sure which PHP version runs your website, or who is responsible for updates? The free cyber check starts right there: we check your site and hosting, clarify who does what, then hand you a clear plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- PHP.net: Security advisory: Critical remote code execution vulnerabilities, update now (October 21, 2026) and Upcoming Critical PHP Security Release (October 20, 2026)
- PHP.net: Supported Versions
- BleepingComputer: PHP warns admins of two critical flaws, emergency patches coming tomorrow (October 20, 2026)
Photo: Pixabay, Pexels (Pexels licence).