On 21 October 2026, the team that develops PHP published a security advisory of unusual severity: two critical vulnerabilities can allow an attacker to run their own instructions on a server, remotely, without an account or a password. PHP powers a large share of websites, including those built with WordPress, PrestaShop, Joomla or Drupal. The PHP team’s instruction is clear: update immediately. Our servers already are, and we can do the same for your website.
What is happening, in plain terms
PHP is the engine that builds the pages of your website on every visit: it fetches the content, assembles it and sends it to the visitor’s browser. The two vulnerabilities fixed (referenced CVE-2026-109618 and CVE-2026-109619) affect that engine itself, not a theme or a plugin. They allow what specialists call remote code execution: someone with no access whatsoever to your website could make it run their own commands, simply by sending it a booby-trapped request.
The PHP team states that the risk is highest on a very common setup (Apache with its built-in PHP module), for which an attack has already been demonstrated: the malicious request acts before your website’s own code even runs. In other words, a well-maintained website, with an up-to-date WordPress or PrestaShop and sound plugins, remains exposed until PHP itself has been updated.
Who is affected?
According to the advisory, every PHP installation that serves visitors on the web is affected, whatever the way the server is configured. In practice, this covers in particular:
- your company website or your online shop, if it runs on WordPress, PrestaShop, Joomla, Drupal or any other tool written in PHP;
- your browser-based applications (intranet, extranet, custom-built business tool) when they are written in PHP;
- the servers you run yourself as well as those a provider manages for you.
If your website is with a hosting provider, it is usually the provider who manages PHP. The PHP team indicates that the major Linux distributions received the fixes in advance, which should let hosting providers react quickly. It is still worth asking yours whether the update has actually been applied to your hosting.
Older PHP versions, the real point to watch
The fixes are available for PHP versions 8.2 to 8.5, as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Versions 8.1 and older no longer receive official updates. Given the severity of the situation, the PHP team has exceptionally provided minimal fixes for versions 7.4, 8.0 and 8.1, but they are meant for those who build PHP themselves, and some vendors offer adapted fixes. For most websites, the lasting solution remains moving to a version that is still supported.
That is often where things get complicated: a website still running on an old PHP version is rarely there by chance. A theme, a plugin or a custom development sometimes blocks the upgrade, and it then has to be adapted before switching over. It is a project to plan ahead, all the more so as PHP 8.2 itself reaches end of life on 31 December 2026.
What about until the update?
The PHP team describes a few settings that reduce exposure to certain forms of attack, for servers that cannot be updated straight away. It is explicit, however: these settings do not make an installation safe, and updating remains the only real solution. They limit the risk while you act, they do not replace the fix.
Our servers are up to date. Are yours?
At IT1 Connect, we have applied the fixes to our servers. We can do the same for yours: check the PHP version of your website or server, apply the update, make sure everything works afterwards and, if your website runs on a version that is no longer maintained, plan the upgrade with you.
Not sure what your website runs on? That is precisely the first thing we check. And so you no longer have to chase this kind of alert, our managed services include keeping your servers’ security updates in hand, alongside monitoring and backup. To have your website checked, call +33 4 22 14 04 63.