Imagine your company's website is working properly. Customers are placing orders, making payments, filling out contact forms, and using your services.
One day, it turns out that the technology behind the website contains a critical security flaw that could allow an attacker to run malicious code on the server without even knowing the username and password.
This is exactly the challenge the world faced on October 21, 2026, when PHP developers released updates to fix two critical security vulnerabilities.
One statistic illustrates the scale of the problem well: According to W3Techs, PHP is used on approximately 69% of websites whose server-side programming language is known.
This doesn't mean that the 69% of the Internet is broken. It means that the problem could affect a vast digital ecosystem if vulnerable systems aren't patched in a timely manner.
The main lesson from this incident is simple: a website doesn't only need technical attention when it goes down. Its security is a daily responsibility.
What happened to PHP security?
PHP is one of the most common server-side programming languages in the world.
Many popular web platforms depend on it, including:
- WordPress
- Drupal
- Joomla
- Web applications built on Laravel
- Various online stores, corporate portals and individual business systems
On October 21, 2026, the PHP security team released updates to fix two critical vulnerabilities:
CVE-2026-109618 – Memory Management Vulnerability
This issue is related to PHP's memory management. Under certain circumstances, an error could corrupt internal memory structures and create the possibility of malicious code execution.
CVE-2026-109619 – Exploiting outdated internal state
The second vulnerability is related to a case where PHP can incorrectly return information related to memory that has already been freed. Under certain circumstances, an attacker could exploit this situation to execute code on the server.
Both vulnerabilities are assigned 9.2 points according to CVSS 4.0, which means critical severity.
Of particular note is the fact that in some server configurations, attacks are possible even without user authentication.
According to the official PHP statement, PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed environments may be at risk. Particular attention is paid to the Apache mod_php configuration, where exploitation was demonstrated even before the execution of application code.
Source: Official PHP Security Statement
Why has this problem become so widespread?
PHP is not just a programming language used by individual developers.
It is the foundation of many web infrastructures.
When a problem occurs in a specific website plugin, the threat is usually limited to the systems that use said plugin.
But when a vulnerability is found in a core component of a programming language, the area of risk becomes much wider.
This can affect both a small business WordPress site and a large corporate system.
That's why cybersecurity agencies from various countries responded to the event. The European Cybersecurity Agency ENISA, CERT-EU, and other organizations urged businesses to immediately check systems running PHP and install security updates.
On October 21, exploit demonstration codes were already being circulated, and on October 22, the New Zealand National Cyber Security Center also reported reports of active exploitation.
However, it is important to distinguish between three situations: A vulnerable system, an attempted attack, and a successfully carried out cyberattack.
Just because a site uses PHP doesn't mean it's already broken.
What can happen to a business if the website is unsecured?
A website security breach is not just a problem of temporarily shutting it down.
The outcome of a successful attack depends on the privileges the compromised service has and what data it has access to.
Possible outcomes are:
1. Loss of user data
If an attacker gains the necessary access to the server, personal information, contact details, and order history could be compromised.
2. Website downtime
Running malicious code on a server may cause service disruption, site modification, or unauthorized use of its resources.
3. Financial loss
For online stores and companies that rely on digital services, even a few hours of downtime can mean lost orders and revenue.
4. Damage to the company's reputation
Rebuilding customer trust is often more difficult than fixing a technical problem.
5. Risk of spreading to other systems
If the compromised server has access to databases, internal systems, or keys to other services, the attacker may gain additional capabilities.
That's why cybersecurity for businesses shouldn't just be an IT department issue. It's part of business continuity and risk management.
How to protect a website from critical PHP vulnerabilities?
1. Check and update your PHP version
This is the first and most important step.
The following security updates were released on October 21, 2026:
| PHP version line | Security update |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | Requires upgrade to a supported version or vendor-approved security patch |
If you use WordPress, you can often check your PHP version from your hosting control panel or from the Site Health section of WordPress.
If you are using a VPS or your own server, the server administrator can check the version.
Note that some Linux vendors backport security fixes into existing packages. In such cases, the version number alone is not enough; you will also need to confirm that the vendor has released a security update.
Important: Updating WordPress, themes, or plugins does not automatically update PHP on the server.
2. Regularly update your entire software infrastructure
Companies often have a system that has been operating for years without significant changes.
The site may be working properly, but it uses:
- Outdated PHP version;
- CMS left without support;
- Old plugins;
- An unupdateable server operating system.
The problem is that smooth operation does not mean safety.
An update control process is needed that includes checking security notifications, prioritizing critical updates, testing for compatibility, and verifying the results.
In the case of critical vulnerabilities, a decision should be made immediately, not on the next scheduled maintenance day.
3. Use backups and verify their restoration
Backup is one of the most important protection mechanisms for a business.
However, simply having a backup is not enough.
Required:
- Regular backups of data and files;
- Storing copies in an environment independent of the main server;
- Appropriate protection against access and deletion;
- Periodic testing of the recovery process.
Note that Backup helps restore the system, but does not fix the vulnerability itself. If the server is already compromised, you need to investigate the incident and restore to a clean environment.
4. Use a multi-layered security system
Good cybersecurity should not depend on a single program or a single firewall.
Businesses need several levels of protection:
Network protection: Firewall, restriction of necessary ports, and control of administrative access to the server.
Web application protection: WAF (Web Application Firewall), request filtering and suspicious activity detection.
Access security: Multi-factor authentication (MFA), strong passwords, and minimum necessary permissions.
Monitoring: Monitor server logs, errors, strange requests, and resource usage.
Manage updates: Timely verification, implementation, and validation of security patches.
In this particular case, the PHP security team emphasizes that Only an update fully resolves the vulnerabilities. WAF and other protection mechanisms are an additional layer of protection and not a replacement for critical patches.
5. Determine in advance who is responsible for system security
One of the most common organizational weaknesses in a business's IT infrastructure is unclear accountability.
The website was created by a developer. The hosting was purchased from another company. The domain is managed by a third party. But who is responsible for security updates?
Who checks for vulnerabilities?
Who makes the decision about critical updates?
And who can respond if a problem arises outside of working hours?
If there are no clear answers to these questions, the company already has operational risk.
That is why it is important to document the infrastructure, identify responsible individuals, and have a pre-agreed incident response process.
What should you do today if your website uses PHP?
Techservice recommends starting with the following practical checks:
- Determine which version of PHP you are running. Check not only the main site, but also additional domains, admin panels, APIs, and other PHP services.
- Check if the security patch is installed. If necessary, contact your hosting provider or server administrator.
- Update the vulnerable environment. Create a backup beforehand, check the compatibility of critical functions, and verify that PHP is actually running after the upgrade.
- Check for suspicious activity. Pay attention to unusual requests, the appearance of new files, administrative changes, and system logs.
- If immediate update is not possible, restrict access. In high-risk cases, it may be necessary to temporarily isolate the public service until the security update is implemented.
- Define a process for ongoing monitoring and updates. A one-time response will not protect you from similar risks in the future.
If there is a suspicion that a server has already been compromised, simply updating the software is not enough. It is necessary to determine the extent of the possible compromise, maintain logs and evidence, and change access keys if necessary.
The most important lesson: Cybersecurity is an ongoing process
There is another important detail in this case.
According to the PHP Foundation, the underlying problem of one of the vulnerabilities was discovered back in 2024. It proved difficult to fully fix, and the real scale of the threat was later confirmed by additional research.
This reminds us that even popular and actively developed software can contain a bug that has gone unnoticed for years.
Therefore, no company should rely on the assumption that using known technology automatically ensures security.
The key question is not whether a new vulnerability can be discovered in technology. The key question is how quickly your company can discover, assess, and eliminate that threat.
This is what distinguishes a simply functioning infrastructure from a properly managed infrastructure.
How does Techservice help businesses manage IT security?
At Techservice, we believe that a company's IT infrastructure should help develop its business, not be a source of constant uncertainty.
Website and server security is not just a matter of software code. It is important to manage the entire environment: server resources, access, updates, backups, and responsibilities.
Our directions include:
- Cybersecurity – Assessing security risks and protection needs of the IT environment;
- Server infrastructure, planning and managing the appropriate technical environment for business systems;
- IT outsourcing and technical support, professional services for the daily technological needs of businesses.
If you don't know which PHP version your site is using, who is responsible for server updates, or how secure your business infrastructure is, now is a good time to find out.
A security audit before a problem is discovered is always a better decision than responding to an incident that has already occurred.
Contact Techservice to discuss the security of your IT infrastructure.
Frequently Asked Question (FAQ)
Are all WordPress sites at risk?
No. WordPress uses PHP, but the risk depends on the version of PHP running on the server, security updates, and specific configuration. Using WordPress does not automatically mean that the site is hacked.
Is it enough to just update WordPress and plugins?
No. These vulnerabilities affect a core component of PHP. PHP itself also needs to be updated.
Does Cloudflare or WAF protect against this vulnerability?
A WAF can block some malicious requests and reduce the risk of attack, but it does not provide complete protection. The official PHP recommendation is to apply the security patch immediately.
What if the site has PHP 7.4 or older?
These versions are outside of official active PHP support. You should plan to migrate to a supported version or apply a security patch specifically approved by the vendor. Remaining on an outdated version for an extended period of time introduces additional risks.
How often should website security be checked?
Security alerts should be monitored continuously. Responses to critical vulnerabilities should be initiated immediately, and scheduled audits, updates, and remediation tests should be planned in accordance with the company's risks and the importance of the systems.
