The short answer: In October 2026, the makers of PHP announced two serious flaws, CVE-2026-109618 and CVE-2026-109619. PHP is the behind-the-scenes software that powers a large share of business websites, including most WordPress sites. The flaws can let a stranger take control of a website without a password, so ask your website company (your host) to confirm your site has been updated.
What happened?
On October 21, 2026, the team that makes PHP warned about two flaws in their software. They also released an update that fixes them.
These flaws are serious. A stranger on the internet could use them to take control of a website. They would not need a password. Once inside, they could see information your site collects, change your pages or use your site to spread harmful software.
The problem is in PHP itself. It is not something you or your website designer did wrong.
Should I be worried?
You should check, this is a severe vulnerability and it is urgent to solve. If your website runs on PHP (most do) and has not been updated, it is at risk. Many websites and web apps run on PHP. Many vibe coded AI apps do as well.
The good news is that the fix already exists. You or your website company needs to install the update. Security add-ons inside your website cannot block this one, website firewalls do not protect against it. The update is what fixes it.
What did Simple Tech do?
If Simple Tech hosts or manages your website, we have already acted. As soon as the warning came out, our team:
- Isolated affected client sites to keep them safe.
- Limited access to approved customer internet addresses where needed.
- Installed emergency updates.
We found no evidence that any site we host or manage was broken into. You do not need to do anything for those sites. If you have questions our team is on standby to help you.
My website is hosted somewhere else. What do I do?
Our updates only covered the websites we host or manage. If another company or marketing firm hosts your site, it may still be at risk.
- Ask your website company today: “Has our website been updated for the October 2026 PHP vulnerability, CVE-2026-109618 and CVE-2026-109619?” Ask for the answer in writing.
- Or let us check it for you. Reply to our email or book a call, and we will tell you where you stand.
- Or move your site to us. We can host your website and handle updates like this one for you.
What should I do now?
- Find out who hosts your website.
- Ask them if your site has been updated for this PHP vulnerability.
- Save their answer with your business records.
- Not sure, or no answer? Call us right now so we can help.
Frequently asked questions
Do I need to do anything?
If Simple Tech hosts or manages your website, no. We already updated it. If another company hosts your site, ask them to confirm it has been updated for CVE-2026-109618 and CVE-2026-109619.
How do I know if my website uses PHP?
If your website is built on WordPress, it uses PHP. If you are not sure, ask your website company, or ask us and we will check.
What is the October 2026 PHP vulnerability?
It is two serious flaws in PHP, named CVE-2026-109618 and CVE-2026-109619. They were announced on October 21, 2026. They can let a stranger take control of a website without a password.
Can a security plugin protect my website?
No. This flaw is in the software underneath your website, so add-ons inside the site cannot stop it. Updating PHP is the fix.
Was my information stolen?
We found no evidence that any site Simple Tech hosts or manages was broken into. For sites hosted elsewhere, ask your website company, or have us check.
For your IT or website person
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws are unauthenticated remote code execution, rated critical (CVSS v4.0 9.2). Every PHP install serving web requests is affected, in every common server mode (PHP-FPM, mod_php, php-cgi and others). Risk is highest for mod_php, where a demonstrated exploit runs before any application code.
| Version line | Fixed in | Note |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Security support ends Dec 31, 2026 |
| 8.1 and older | None from the PHP project | Call us immediately if you are running older versions. |
The advisory lists temporary configuration mitigations, but states only updating is a complete fix. In WordPress, the PHP version is under Tools, then Site Health, then Info, then Server.
Sources: php.net security advisory (Oct 21, 2026), GHSA-w8hw-w9fx-j79w (CVE-2026-109618), GHSA-6wmf-4rv5-p3rp (CVE-2026-109619), PHP supported versions.