Critical PHP Vulnerabilities: How to Fix Your Website Now

What happened

On 21 October 2026, the PHP project released emergency patches for two critical security flaws known as the PHP2Shell vulnerabilities. PHP is the programming language behind most of the web, including every WordPress website.

The two flaws, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 out of 10 (Critical). In the worst case, an attacker can send a specially crafted request to a website and run their own code on the server, without logging in. From there, they could read server files, steal passwords and API keys, or reach the website’s database.

The issue sits in PHP itself, not in your website’s code. That means a site can be exposed even if its theme, plugins and custom code are all secure and up to date.

The critical PHP security vulnerabilities have made mainstream news, and security firms have already seen attackers probing for them. Public proof-of-concept exploits are circulating. As of 22 October, no successful break-in had been publicly confirmed, but the window to patch is short.

Why these PHP vulnerabilities are so serious

Most website attacks need a weak password, an outdated plugin or a user to click something. These flaws need none of that. Three things make them stand out:

• No login required. An attacker does not need an account or any access to your website. A carefully crafted web request is enough.
• The attack can happen before your site’s code runs. On some common server setups, a single request can trigger the flaw before WordPress even loads, so website-level defences may never see it.
• Sensitive data can leak. One of the flaws can expose parts of the server’s memory, which may contain passwords, login tokens and API keys for connected services such as payment gateways or email platforms. Security firm Qualys explains this PHP memory disclosure risk in more detail.

Once attackers can run code on a server, they can plant malware, steal customer data, change website content or use the server to attack others.

Is your website at risk?

If your website runs on PHP and the server has not been updated since 21 October 2026, assume it is at risk. That covers nearly every WordPress, WooCommerce, Drupal, Joomla and Laravel site.

The flaws reach back many years of PHP releases. Sites on older, unsupported versions (PHP 8.1 and earlier) are the most worrying, because they often miss routine security updates too.

These are the safe PHP versions released by the PHP project:

One caution: some hosting providers apply the fix without changing the version number you see. The only reliable answer comes from your host confirming that CVE-2026-109618 and CVE-2026-109619 are patched on your server.

How to check your website’s PHP version

You can find your PHP version in a couple of minutes:

1. In WordPress: log in to your dashboard, go to Tools → Site Health, open the Info tab and expand the Server section. Your PHP version is listed there.
2. In your hosting control panel: most panels, such as cPanel or Plesk, show the PHP version under a “PHP settings” or “Select PHP version” option.
3. Ask your host or developer: if you do not have access to either, your hosting provider or web agency can tell you.

Remember that the version number alone may not tell the full story. Some hosts patch older versions behind the scenes, so always ask them to confirm the fix directly.

WordPress sites: plugins help, but they are not the fix

If your website runs on WordPress, make sure a security plugin is installed, active and properly configured. A well-set-up plugin adds a firewall, blocks suspicious requests, scans for malware and alerts you to unusual activity. It is one of several website security best practices every business site should follow.

But updating WordPress, its themes or its plugins does not update PHP underneath. PHP is part of the server, and only the server can be patched. A security plugin is one layer of protection; the PHP patch is the one that closes the hole.

How to fix the PHP vulnerabilities on your server

The only complete fix is to update PHP to a patched version (listed in the table above), then restart PHP and the web server so the update takes effect. Who does this depends on your hosting:

• Shared or managed hosting: your hosting provider applies the update. Many large hosts have already patched or added protective rules, but do not assume yours has.
• Your own server (VPS, cloud or dedicated): your developer or IT team needs to install the PHP security update and restart the services.

To confirm the fix is in place, ask your hosting provider these questions:

1. Have the PHP patches for CVE-2026-109618 and CVE-2026-109619 been applied to our server?
2. Which PHP version is our website running, and is it still supported?
3. Were PHP and the web server restarted after patching? The fix only takes effect after a restart.
4. Is a web application firewall (WAF) in place to block attack traffic at the server level?
5. If patching is delayed, what temporary protections have you applied?

If your host cannot confirm a fix, consider temporary measures such as putting the site behind a firewall service like Cloudflare, or taking non-essential sites offline until it is patched.

Warning signs your website may have been targeted

Researchers tracking these flaws have shared the signs of PHP2Shell exploit attempts that may show up on a targeted server. Watch for:

• Repeated “500 Internal Server Error” pages or memory-limit errors in your server logs
• PHP or web server processes restarting for no clear reason
• Unusually large or strange-looking session cookies in your server logs

More general signs of a compromised website include:

• New admin users you did not create
• Unfamiliar files or plugins on the server
• Visitors being redirected to spam or scam sites
• Google showing a “This site may be hacked” warning in search results
• A sudden drop in website speed or a spike in server resource usage

If you notice any of these, contact your host and your web team straight away. Do not wait for the problem to grow.

What a hacked website can cost your business

A website breach is not only an IT problem. It can hit your business in several ways:

• Customer data and PDPA obligations. If your website stores customer names, emails, enquiry forms or orders, a breach may put that data at risk. Under Singapore’s Personal Data Protection Act (PDPA), organisations must make reasonable security arrangements to protect personal data, and certain breaches must be reported to the PDPC.
• Lost search rankings. Google may flag or remove hacked pages from search results, undoing years of SEO work.
• Downtime and lost leads. A site taken offline to clean up malware cannot generate enquiries or sales.
• Damage to trust. Customers who see a warning page or spam content may not come back.

The cost of confirming a patch today is small compared with the cost of cleaning up after a breach.

Your quick checklist

• Confirm with your host that both PHP patches are applied and services restarted
• Check your PHP version and plan an upgrade if it is 8.1 or older
• Make sure a security plugin is installed and configured on WordPress sites
• Update WordPress core, themes and plugins as part of the same review
• Change admin, database and API passwords if you suspect anything unusual
• Confirm you have a recent, working backup stored off the server

Frequently asked questions

Does updating WordPress fix the PHP vulnerabilities? No. WordPress, themes and plugins run on top of PHP. Updating them does not update PHP itself, which is managed on the server by your hosting provider.

My site has a security plugin. Am I safe? A security plugin lowers your risk, but it cannot patch PHP. In some setups the attack can happen before WordPress loads. You still need your host to apply the server patch.

Has anyone been hacked through these flaws yet? Security firms have reported attackers actively probing for them, and test exploits are publicly available. Amazon’s security team even recorded an early PHP2Shell exploitation attempt four days before the flaws were made public. As of 22 October 2026, no successful break-in had been publicly confirmed. That can change quickly, so patch now rather than wait.

What if my website runs on PHP 7 or PHP 8.1? These versions no longer receive official updates. Your host may still be able to apply a fix, but the safer long-term step is to upgrade your site to a supported PHP version.

What if my host cannot patch straight away? Ask what temporary protections they can apply, such as firewall rules. For non-essential sites, consider taking them offline until the patch is confirmed.

How Impossible Marketing can help

Keeping PHP and server software up to date is a core part of keeping any website secure. Through our website development services, we help businesses upgrade older websites to a supported PHP version and put the right security measures in place.

Not sure where your website stands? Request a website security check and our team will help you confirm your PHP version, review your security setup and follow up with your host.