Critical PHP Security Update: What Website and Web App Owners Need to Do

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities. The flaws could allow an attacker to run code on an affected server without logging in. PHP’s security team rated both vulnerabilities 9.2 out of 10 and urged users to update immediately. Reuters reported that websites were taken offline as operators worked to protect their systems.

This is a PHP security issue, not a vulnerability in WordPress, Laravel, a particular plugin, or a theme. But it matters to any website or web application running PHP. Updating application code or dependencies does not update the PHP runtime underneath them.

What the update fixes

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve PHP’s handling of request state after certain fatal errors. In specific circumstances, corrupted or stale internal data can be used to execute an attacker’s code. Some demonstrated attack paths can affect the PHP worker before an application’s own code runs. Flavio Copes’ technical summary explains the issue and why application-level protections may not prevent every attack path.

The PHP project released these fixed upstream versions:

Your hosting provider or Linux distribution may deliver the fix as a backported package with a different version string. Check the provider’s security notice or ask support to confirm that the package running your application includes fixes for both CVEs. A version number alone may not tell the whole story.

Why WordPress and Laravel applications are in scope

WordPress and Laravel use PHP, so their security depends in part on the PHP runtime serving them. A WordPress site with up-to-date core, plugins, and themes can still be exposed if its PHP runtime is vulnerable. The same principle applies to Laravel applications: updating Composer packages does not patch PHP itself.

Wordfence’s advisory notes that WordPress automatic updates do not install PHP security updates. PHP is generally managed by the hosting provider or server administrator. Laravel teams should likewise check who manages PHP in their hosting platform, virtual machine, or deployment containers.

If you use managed hosting, ask the provider whether the PHP runtime for each application has been patched. If you manage your own server, update PHP through the system, control panel, or container platform that supplies it, then restart the services or workers so they load the patched runtime.

If you deploy a container, make sure the image itself is rebuilt or replaced with a patched PHP base image. Restarting an existing container does not change the PHP version inside its image.

Update carefully, and verify the result

The severity calls for prompt action, but a production PHP change should still be handled in a controlled way. Before upgrading, take a fresh backup and confirm that it can be restored. Where possible, test the PHP update on a staging copy first. For WordPress, check important pages, forms, logins, and checkout flows. For Laravel, test key user journeys, integrations, scheduled tasks, and queue workers.

Older application code or dependencies may not work correctly on a newer PHP branch. If your application runs an unsupported PHP version, ask your host whether it has applied a maintained security backport and plan a tested move to a supported branch. Don’t assume that an old version is patched—or that a change of version number is required—without checking the package provider’s advisory.

After the update, verify the PHP version or package used by the web server, not only the command-line PHP version, which can differ. Restart relevant PHP services and long-running workers, then check the application and review logs for errors. A firewall or temporary configuration change may reduce exposure in some cases, but it should not be treated as a replacement for the PHP fix.

The BBC report describes organizations taking websites offline while responding to the warning. That was a precaution for operators who could not promptly secure their systems; it does not mean every application owner should take a patched site offline. If you cannot confirm that an exposed application is protected and need time to remediate it, ask your host or security professional about a safe temporary response. Simply disabling PHP handlers can expose PHP source code if the web server is misconfigured.

Practical checklist for website and web app owners

• Identify every PHP website and application you operate, including WordPress sites, Laravel apps, staging systems, and older projects.
• Find out which PHP runtime serves each one and who is responsible for updating it.
• Ask your hosting provider to confirm that the runtime or package includes fixes for CVE-2026-109618 and CVE-2026-109619.
• If you manage PHP, back up the application and data, then install the fixed package from your operating system, hosting control panel, or container provider.
• If you deploy containers, rebuild and redeploy using a patched PHP base image.
• Restart the relevant PHP services, queue workers, and other long-running processes so they load the patched runtime.
• Test key application features and integrations, and review error and security logs after the update.
• If the application runs an unsupported PHP version, confirm whether the vendor supplies a backport and plan a tested upgrade.
• If you suspect compromise, preserve relevant logs and seek help with investigation and recovery. Applying the patch does not by itself remove malicious changes that may already be present.

Need help securing your website or web application?

If you’re unsure which PHP runtime your website or application uses, or who is responsible for updating it, contact Mactavis for help checking and updating your site. Our WordPress Maintenance service includes ongoing updates, backups, security monitoring, and support for WordPress sites.

We also build and maintain PHP-based web applications, including Laravel applications. Contact Mactavis to discuss PHP updates and application maintenance for your project. Our Application Maintenance service covers security maintainance for your PHP-based web applications and APIs.

If your WordPress website is hacked, infected, or inaccessible—or you suspect it may have been compromised—our WordPress Recovery & Website Incident Response service can help with recovery, malware removal, restoration, and security hardening.