PHP Security Update October 2026: What Website Owners Need to Do Now

Why a PHP flaw is different from a plugin flaw

Most website security advice focuses on plugins, themes and CMS updates, and those are important. These two vulnerabilities are different because they sit inside PHP itself, in the parts that handle memory and errors on nearly every request. Updating your plugins will not close them. The fix has to be installed on the server, which means it is the responsibility of your hosting provider, your web developer or whoever manages your website’s technical setup.

This is also why many owners miss it. Nothing looks wrong on the website, the dashboard shows no update notification, and the risk sits one layer below what most people ever see.

What the two vulnerabilities do

The first, CVE-2026-109618, is caused by a memory problem. If a request reaches PHP’s memory limit at a very specific moment, PHP can leave partly prepared data behind and later trust it, which corrupts memory. On Apache servers using mod_php, a visitor with no account can trigger this before any of the website’s own code runs, and researchers demonstrated full code execution using default settings. It was also confirmed on PHP-FPM setups through application-level code paths.

The second, CVE-2026-109619, comes from a fatal error that can leave PHP pointing at memory belonging to an earlier request. A later request handled by the same worker may then use that memory after it has been released. Researchers confirmed a crash and showed code execution against a real application running on Apache with mod_php.

In practical terms, a successful attack could let someone take control of the server, change website files, inject spam or malicious scripts, steal customer data or take the site offline. For an online store, that can mean lost orders and damaged customer trust. For a service business, it can mean search visibility lost to a hacked site that Google then flags.

Why this should be treated as urgent

The details became public sooner than planned. The CVE numbers circulated online on October 20, a security firm accidentally published a video of its proof of concept, and one software distributor released patched images hours before the agreed time, which let attackers study the fix early. The PHP team reported that it had found no working exploits at the time of release, but that situation can change quickly once a fix is public. Servers still running an older PHP version after this point are the ones most exposed.

Which websites are affected

Any website running PHP on a version that has not received these fixes is potentially exposed. That includes:

• WordPress websites and WooCommerce stores
• Joomla websites, especially older ones that were never moved to a current version
• Magento and Adobe Commerce stores
• Custom PHP applications, portals and booking systems
• Websites on shared hosting where the provider controls the PHP version

Websites on older, unsupported PHP versions carry extra risk, because those branches may not receive a fix at all. In that case the only safe route is an upgrade to a supported release.

What to do right now

1. Check your current PHP version. Your hosting control panel shows it, or your developer can confirm it in a few minutes.
2. Move to a patched release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. If you are on an older version, plan an upgrade to a supported one.
3. Ask your hosting provider whether they manage PHP updates and when the patch will be applied to your server.
4. Test the website after the update. Check contact forms, checkout, logins, plugins and any custom extensions, since a newer PHP version can expose compatibility problems in older code.
5. Back up before and after. A recent backup makes recovery simple if something misbehaves.
6. Review your site for signs of compromise if you suspect it was exposed, such as unfamiliar files, unexpected admin accounts, strange redirects or sudden spam pages.

Where older websites run into trouble

The update itself is usually quick. The harder part is what happens afterward on websites that have been left alone for years. Older themes, abandoned plugins and custom extensions written for earlier PHP versions can break on a newer release, and that is the reason many owners delay updating, which in turn keeps them exposed. It is also why a Joomla site still sitting on an end-of-life version, or a WordPress site stacked with unmaintained plugins, benefits from a planned upgrade instead of an emergency patch.

How Ovelovia can help

Ovelovia works with PHP-based websites every day, so this update fits directly into services we already provide:

• PHP version checks and server-level updates, so your site runs on a supported, patched release.
• Joomla upgrade and migration services for sites on outdated versions, including custom extension updates and, where it makes sense, a move to another platform. Our Joomla CMS guide explains the current version situation.
• WordPress and Magento maintenance covering core, plugin and extension updates, compatibility testing and regular backups.
• Website security hardening and malware cleanup for sites that may have been exposed or already show signs of compromise.
• Ongoing website support plans so that updates like this one are handled on schedule, with testing, instead of discovered after the fact.

If you are not sure which PHP version your website runs on, or you would like someone to apply the update and test everything afterward, contact the Ovelovia team and we will review your setup.