Most business owners have never heard of PHP, and that’s fine. You don’t need to know how your car’s fuel injectors work either. But if your website runs on WordPress, WooCommerce, Joomla, Drupal, or Magento, it runs on PHP, and this morning the people who make PHP shipped emergency fixes for two flaws they rate as critical.
This is one of those weeks where a five-minute email to your web host is worth more than anything else you’ll do for your website all year.
Already a Digital Atmospheres hosting customer? You’re covered. Our security team applied server-level protection across all of our servers ahead of the release, so there’s nothing you need to do. The rest of this post is for everyone else, including any site of yours that lives on someone else’s server.
What happened
On Tuesday evening the PHP project gave advance notice of a security release, scheduled for 10 AM Eastern today, October 21. It fixes two vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 out of 10. Both can allow what PHP calls “unauthenticated remote code execution.”
In plain English: someone on the internet, with no password, sends a specially crafted request to your website and gets to run their own commands on the server. That’s the whole ballgame. Customer data, your contact forms, your checkout page, the site itself. All of it.
A few details worth knowing:
- The attack happens before your website’s code even runs. PHP’s own advisory describes a demonstrated exploit where a single request can trigger it “before any application code runs.” Your security plugin never gets a vote.
- It abuses ordinary features. The trigger involves how PHP handles form submissions and file uploads, including a session upload-progress feature that is on by default.
- Details leaked early. The flaws’ existence and scores were posted publicly before the planned date, which is why PHP moved fast. As of this morning no one had reported attacks in the wild. With fixes now public, attackers can study exactly what changed. That clock is running.
The fixed versions
If your site runs one of these PHP versions or newer, you’re patched:
- PHP 8.5: fixed in 8.5.12
- PHP 8.4: fixed in 8.4.27
- PHP 8.3: fixed in 8.3.36
- PHP 8.2: fixed in 8.2.35
Many hosts install fixes on their own schedule, and good Linux distributions received the patches in advance. So “patched” may mean your host’s version of 8.3, not the exact number above. That’s a question for them (more on that below).
The trap: older PHP gets no fix
Here’s the part that worries me. PHP 8.1 and everything before it are past end of life. The PHP project says plainly that these versions “no longer receive updates.” There’s no official fix coming.
And there are a lot of them. Security firm Mallory counted roughly 884,000 internet-facing servers reporting PHP 8.1 or older on Tuesday, about 59% of servers that show a version at all (via The Hacker News). Plenty of those belong to small businesses whose site got built, worked fine, and never had its server settings touched again.
One more date for your calendar: PHP 8.2 reaches end of life on December 31, 2026. If you’re on 8.2, you’re fine today, but plan the move to 8.3 or 8.4 now instead of in another emergency.
“We’re too small to be a target” stopped being true
I hear this one a lot, and I understand it. Why would anyone bother with a landscaping company’s website?
Because nobody is choosing you. This week Reuters and security firm NorForge reported that one attacker pointed autonomous AI agents at more than 1,200 online stores and broke into more than 100 companies, including household names. The agents worked mostly unsupervised. The whole campaign cost about $5,000, roughly $50 per successful break-in.
Fifty dollars. That’s the going rate to find a hole in a website and plant a back door, and it’s falling. When attacking costs that little, attackers don’t pick targets. They try everyone and keep whatever works. An unpatched PHP server is exactly the kind of thing that “works.”
How to find your PHP version in two minutes
You don’t need to be technical. Try whichever of these fits your setup:
- WordPress: Log in, go to Tools → Site Health → Info, and open the Server section. Your PHP version is listed there.
- cPanel hosting: Look for Select PHP Version or MultiPHP Manager on the main dashboard.
- Plesk: Open your domain and look under PHP Settings or PHP version.
- Managed or “website builder” hosting: Check your host’s dashboard or knowledge base, or just ask support (see below).
Write the number down. If it starts with 7, or with 8.0 or 8.1, treat this as urgent.
What to ask your host
Send your hosting provider or web developer this email. Copy it word for word if you like:
“Has our server been updated for the PHP security release of October 21 (CVE-2026-109618 and CVE-2026-109619)? What PHP version is our site running, and is it still supported? If it isn’t, what’s the plan and the date to upgrade?”
A good host will answer that in a day. A vague or slow answer tells you something too.
If you’re on an old version, upgrading PHP can break an old theme or plugin. That’s not a reason to wait. It’s a reason to test first. A competent developer can stand up a copy of your site, upgrade it, fix what breaks, and then switch over.
What to do this week
- Find your PHP version using the steps above.
- Email your host with the question above and get a written answer.
- If you’re on 8.1 or older, schedule the upgrade now. If it can’t happen quickly, ask about temporary protection: a web application firewall in front of the site, or the PHP project’s published configuration workarounds.
- Confirm you have a recent backup that’s stored somewhere other than the web server itself.
- Update WordPress, your theme, and your plugins while you’re in there. Today’s attackers rarely need just one open door.
When in doubt, make one call
Most of the websites we inherit at Digital Atmospheres have the same story: built well years ago, and nobody has checked under the hood since. That’s not negligence. It’s what happens when the person who built your site moved on and the hosting bill quietly auto-renews.
If you aren’t sure what your site runs on, who’s responsible for patching it, or whether your backups would actually restore, we’ll take a look. A website health check covers your PHP version, hosting, plugins, and backups, and you get a plain-English list of what needs attention and what doesn’t.
Book a Teams meeting or call and we’ll get you a straight answer.