Website security is a growing concern as new PHP vulnerabilities expose weaknesses in the technology behind many business websites. In October 2026, PHP users are facing a series of serious security warnings that call for attention from website owners, developers, and hosting administrators.
Two critical vulnerabilities disclosed on October 21 could allow attackers to execute malicious code on vulnerable PHP servers without authentication. Two days later, on October 23, the PHP project issued another advisory about a separate, potentially exploitable configuration issue.
These developments highlight the importance of keeping website infrastructure updated and responding quickly to security advisories. Businesses running PHP-powered websites should review their environments, confirm that security updates have been applied, and ensure that their hosting configurations are not exposing them to unnecessary risk.
Latest PHP Security Issues Right Now
PHP is a widely used technology for building and maintaining websites, including WordPress websites, Drupal and Joomla installations, and custom web applications.
Recent security disclosures have brought attention to three issues:
- CVE-2026-109618: A critical vulnerability involving memory handling during certain error conditions.
- CVE-2026-109619: A critical vulnerability involving internal PHP state that may reference memory after it has been released.
- CVE-2026-115560: A separate issue disclosed on October 23 that may create a remote code execution risk under a specific combination of application settings and PHP session configuration.
The first two received emergency security updates on October 21. The third is being handled through the regular PHP release cycle, and the PHP team recommends a temporary configuration change until a fix is available.
These PHP security issues do not affect every website the same way. Exposure depends on the PHP version, the hosting environment, and, for the newest issue, a specific combination of application behavior and configuration.
What Is a PHP Remote Code Execution Vulnerability?
A PHP remote code execution vulnerability lets an attacker run their own code on a server from a remote location. When the flaw sits in the software that processes web requests, an attacker may be able to target the server without using any visible website feature.
Successful exploitation of the two critical vulnerabilities could enable unauthorized code execution or the disclosure of sensitive information held in process memory. The newest issue, CVE-2026-115560, may create a remote code execution risk, but only under the specific settings described in the advisory.
How PHP Vulnerabilities Can Affect Your Business
A website can appear to work normally while its underlying server software remains vulnerable. When a weakness exists in the technology responsible for processing web requests, an attacker may be able to target the server without exploiting a visible website feature.
Website Compromise
Attackers may be able to modify website files, interfere with site functionality, or establish unauthorized access.
Exposure of Sensitive Data
Information in server memory may include authentication tokens, credentials, or other confidential information.
Service Interruptions
Malicious activity or attempts to exploit a vulnerability can affect website availability and reliability.
Additional Security Risks
A compromised server may create further risks for applications, databases, or other resources accessible from the affected environment.
These are potential consequences, not evidence that every vulnerable website has been compromised. Nevertheless, businesses should not wait for visible damage before checking their security status.
A New PHP Security Warning Has Emerged
The latest development is a separate security issue tracked as CVE-2026-115560.
According to the PHP project's October 23 advisory, the issue involves an unusual combination of session serialization settings and application behavior. It is not considered a universal vulnerability affecting every PHP application, and no exploitation of this specific issue had been reported in the security coverage available on October 23.
The PHP team recommends disabling session upload progress until the next regular bug-fix release to address this risk.
session.upload_progress.enabled=0
This configuration change should be implemented by a qualified developer or server administrator in the appropriate PHP configuration and applied to the relevant workers.
Importantly, this additional advisory does not mean that all recently updated PHP installations remain exposed to the original critical vulnerabilities. It is a separate issue requiring its own assessment and appropriate mitigation.
Which Websites Are at Risk?
Any internet-facing website or application that uses PHP should be reviewed, including:
- WordPress websites and custom WordPress installations
- Drupal and Joomla websites
- Custom PHP applications and web portals
- Websites on shared or dedicated servers
- PHP applications deployed through containers or cloud infrastructure
Websites on older PHP versions deserve particular attention. The PHP project has released fixes for supported branches, while PHP 8.1 and older versions have generally reached end of life and no longer receive routine fixes. Some vendors provide backported patches, so confirm the status of your specific installation instead of assuming it is unpatched.
A website's content management system version alone is not enough to establish whether the underlying PHP environment is secure.
PHP Security Best Practices: 6 Steps to Consider Immediately
You do not need a full website rebuild to respond. Start by identifying the affected software and confirming which updates or configuration changes are needed.
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older versions are generally end-of-life and no longer receive routine fixes from the PHP project. Some vendors may provide backported security patches, so confirm the status of your specific installation rather than assuming that every older package is unpatched.
A developer or server administrator should assess whether the application uses the configuration combination described in the advisory and implement the recommended mitigation where appropriate.
Do not make production configuration changes without understanding their effect on file uploads, application sessions, and website functionality.
A patch prevents exploitation through the fixed vulnerability, but it does not automatically establish whether a server was compromised before the update.
Verify the runtime used by the live website, restart or redeploy affected services as required, and confirm that all relevant environments have been updated.
Not sure which PHP version your website runs? Directory One can review your website’s software, configuration, and security status. Contact us today to schedule a website security review.
How AI Is Changing PHP Security Vulnerabilities
The current PHP security situation also reflects a broader change in cybersecurity. Artificial intelligence is helping researchers analyze complex software and find vulnerabilities that may have existed for years.
AI-assisted security research can help identify weaknesses, test potential fixes, and investigate how vulnerabilities behave across different environments. These capabilities can benefit defenders, but they can also lower the effort required to develop or adapt attacks.
For businesses, this makes timely patching and continuous monitoring even more important. Security should not rely on the assumption that widely used software is automatically free from serious flaws.
The Importance of Website Maintenance
A business website is often central to its digital presence. It supports search visibility, lead generation, customer communication, and brand credibility.
When the underlying technology is outdated or improperly configured, those business objectives may be placed at risk.
Regular website maintenance helps businesses keep their software current, identify technical issues, and establish a clear process for responding to newly disclosed vulnerabilities. It also provides an opportunity to review performance, reliability, backups, and other important aspects of website health.
At Directory One, we recognize the importance of maintaining a strong technical foundation for business websites. Website owners should understand which technologies their sites depend on and ensure that the appropriate developers or hosting administrators are responsible for maintaining them.
If your website has not had a recent technical review, now is a good time to verify its software versions, security updates, and server configuration. Addressing known issues promptly can help reduce avoidable risks and support a more reliable online presence.
Frequently Asked Questions
Protect Your Website With Directory One
The latest advisories show that website care goes beyond design and content updates. Software versions, server configuration, and fast security fixes all protect your business website.
At Directory One, we help businesses keep a strong technical foundation, from website maintenance to WordPress security services. If your site has not had a recent technical review, now is the time to verify your PHP version, security updates, and server configuration.
Contact Directory One today to book a website security review and reduce your exposure to known PHP vulnerabilities.
Security information in this article reflects publicly available advisories as of October 23, 2026. Technical details and remediation guidance may change as additional updates become available.