Critical PHP Vulnerabilities 2026: Why Website Owners Need to Act Now

Attackers are targeting new PHP vulnerabilities, and many business websites run on PHP. Website owners, developers, and hosting teams should pay attention this week.

On October 21, the PHP project disclosed two critical flaws. Attackers could use them to run malicious code on a server without logging in. Two days later, the project posted a third advisory about a risky configuration.

So check your setup, confirm your updates are live, and do not wait for visible damage.

What Is Going On With PHP Right Now?

PHP powers WordPress, Drupal, Joomla, and many custom web apps. Three issues need your attention.

• CVE-2026-109618 is a critical flaw in how PHP handles memory during certain errors.
• CVE-2026-109619 is a critical flaw where PHP may use memory after it has been freed.
• CVE-2026-115560 is a third issue from October 23. It may allow remote code execution under a specific mix of settings.

The PHP team fixed the first two on October 21 with emergency updates. The third will get a fix in a regular release. Until then, the team suggests a temporary setting change.

Not every site faces the same risk. Your exposure depends on your PHP version, your host, and your settings.

What Does Remote Code Execution Mean for You?

A remote code execution flaw lets an attacker run their own code on your server from far away. Because the flaw sits in the software that handles web requests, attackers do not need a visible site feature to get in.

If attackers exploit the two critical flaws, they could run code or read sensitive data from server memory. The newest issue could also allow code execution, but only with the settings the advisory describes.

How Could These Flaws Hurt Your Business?

A site can look normal while the server underneath stays vulnerable. Here is what attackers could do.

• They could change your files, break your site, or set up hidden access.
• They could read tokens, passwords, or other private data from memory.
• They could slow or stop your site with malicious traffic.
• They could use your server to reach your databases and other tools.

These are possible outcomes. They do not mean every vulnerable site has been hacked. Still, you should check your status before damage appears.

What Is Different About the Newest Advisory?

CVE-2026-115560 involves an unusual mix of session settings and application behavior. It does not affect every PHP app. Reports available on October 23 showed no attacks using this issue.

The PHP team suggests turning off session upload progress until the next bug-fix release. The setting looks like this.

session.upload_progress.enabled=0

A qualified developer or server admin should apply it and reload the relevant workers. This advisory does not mean your updated servers still have the first two flaws. It is a separate issue, so it needs its own review.

Which Websites Should You Check?

Check any public site or app that uses PHP. That includes these.

• WordPress sites, including custom installs
• Drupal and Joomla sites
• Custom PHP apps and web portals
• Sites on shared or dedicated servers
• Apps running in containers or the cloud

Older versions need extra care. PHP 8.1 and older have mostly reached end of life, so the PHP project no longer fixes them regularly. Some vendors do backport patches, so ask before you assume a version is unpatched. Your CMS version alone cannot tell you whether PHP is safe.

How Can You Protect Your Site in Six Steps?

You do not need to rebuild your website. Start by finding out what you run.

First, find your PHP version

Ask your host or developer which PHP version your live site uses. If you run several sites, check each one.

Next, install the patched PHP releases

The first fixed releases for the two critical flaws are below.

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Your operating system vendor or host may offer later security packages too, so ask them.

Then review your PHP settings

A developer should check whether your app uses the combination in the advisory. If it does, they should apply the suggested fix. Test first, because the change can affect file uploads and sessions.

Look for signs of an attack

If your site ran a vulnerable version, review server logs, login records, PHP errors, and odd processes. Also look for file changes you cannot explain. A patch blocks future attacks through the fixed flaw. However, it cannot show whether someone got in earlier.

Make sure the update is live

A new PHP package may not help if old workers or containers keep running. Check which runtime your live site uses. Restart or redeploy services as needed, and confirm every environment has the update.

Keep reviewing your security

Watch for updates, check your settings, and keep backups. Name one person who acts on critical advisories.

Not sure which PHP version you run? Directory One can review your software, settings, and security status. Contact us today to book a website security review.

Why Is AI Changing PHP Security Vulnerabilities?

AI now helps researchers study complex software. It can find flaws that stayed hidden for years. Researchers also use it to test fixes and see how flaws behave in different setups.

Attackers can use the same tools to build attacks faster. So patch quickly and keep watching your servers. Popular software is not automatically safe.

Why Does Website Maintenance Matter?

Your website supports search visibility, leads, customer contact, and your brand. Old or misconfigured software puts those goals at risk. Regular maintenance keeps software current and helps you spot problems early. It also gives you a plan for new advisories.

At Directory One, we help businesses build a strong technical base for their sites. Know which technologies your site uses. Make sure a developer or host is responsible for each one. If your site has not had a recent review, check your software versions, updates, and server setup now.

Frequently Asked Questions

Are all PHP websites vulnerable?

No. The two critical flaws affect vulnerable PHP installations. The newest issue needs a specific mix of settings and behavior. You must check each environment.

Does updating WordPress fix these flaws?

No. WordPress updates do not change the PHP runtime. You must apply the PHP security updates too.

Are attackers using the newest issue?

As of October 23, 2026, reports showed attempts against the two earlier flaws. Coverage had not shown attacks on CVE-2026-115560.

What should I ask my hosting provider?

Ask which PHP version your site runs. Ask whether the critical updates are installed. Then ask whether the session upload progress advisory applies to you. Finally, ask if you need other fixes.

Do updates guarantee my site is safe?

No. Updates fix specific flaws. They cannot remove every risk or show whether a past break-in happened. Keep monitoring and maintaining your site.

Protect Your Website With Directory One

Software versions, server settings, and fast fixes all protect your business. Contact Directory One today to book a website security review. We will help you reduce your exposure to known PHP vulnerabilities.

This article reflects public advisories as of October 23, 2026. Details and guidance may change as new updates appear.