Your website may appear to work perfectly. That does not necessarily mean its server software is up to date and secure. Recent PHP security announcements highlight why regular maintenance matters for business websites and online stores alike.

Two critical PHP vulnerabilities disclosed on 21 October 2026 can allow attackers to execute code remotely without logging in under certain conditions. This article reflects official announcements available as of 31 October 2026.

1. What Is PHP and Why Does It Matter?

PHP is a programming language that handles server-side website operations. It powers features such as administration panels, contact forms, user accounts and database connections.

A modern-looking website can still run an outdated PHP version. Security maintenance therefore needs to be tracked separately from content updates.

2. What Are the Latest PHP Vulnerabilities?

The two critical vulnerabilities disclosed in October concern PHP memory and request handling:

• CVE-2026-109618: This issue involves unsafe handling of operations interrupted by an out-of-memory condition. Under suitable conditions, it can lead to remote code execution.
• CVE-2026-109619: This issue involves invalid memory references from one request being used by a later request. Exposure depends on the server and application configuration.

Remote code execution means an attacker may perform operations with the privileges of the account running the web application. Files and data accessible to that account could be at risk. Technical details are available in the PHP team's first security advisory and second security advisory.

3. Which Websites Could Be Affected?

Business websites, content management systems, online stores and custom applications using PHP should be reviewed. The PHP team identifies several environments as potentially at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. This does not mean every installation is exploitable under the same conditions.

Updating WordPress or another content management system does not necessarily update the server's PHP package. Application and server updates need separate checks.

4. Which PHP Versions Include the Fixes?

The following releases include fixes for the two critical vulnerabilities announced on 21 October:

• PHP 8.2: 8.2.35
• PHP 8.3: 8.3.36
• PHP 8.4: 8.4.27
• PHP 8.5: 8.5.12

When updating, also check for any newer stable release in the appropriate branch. Some Linux distributions and support providers backport security fixes to their existing packages. Verify the provider's patch information rather than relying on the version number alone. Installations using PHP 8.1 or older should plan a migration to a supported branch.

5. Do Windows Servers Need an Additional Update?

On 26 October 2026, the PHP team published rebuilt Windows packages addressing CVE-2026-111497 in the Brotli dependency: 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1.

The affected decoder can be reached through cURL when automatic HTTP response decompression is enabled. The “-1” suffix identifies a Windows package rebuilt with updated dependencies; the PHP runtime version itself does not change. Checking only the displayed PHP version may therefore be insufficient.

6. What Should Website Owners Do?

1. Identify the active version: Confirm the PHP version actually serving your website through your hosting panel or provider.
2. Back up your website: Prepare current, recoverable copies of both files and the database.
3. Test first: Try the update in a staging environment where possible.
4. Confirm the patch: Ask your hosting provider whether the relevant security fixes have been applied.
5. Check essential features: Test sign-in, contact forms, file uploads and payment flows, where applicable, after the update.

You can ask your hosting provider: “Does the PHP package serving my website include the fixes for CVE-2026-109618 and CVE-2026-109619? If the server runs Windows, does it also include the latest Brotli update?”

7. Can Temporary Measures Replace an Update?

The PHP team has described configuration measures that reduce exposure to specific attack paths. An additional advisory on 23 October recommended session.upload_progress.enabled=0 for a risk involving an unusual session configuration. A server administrator should assess this setting and apply it in the appropriate server configuration.

Temporary settings do not replace upgrading to a release containing the fixes for both critical vulnerabilities. Work with your hosting provider or technical team instead of changing server settings at random.

8. Website Security Requires Ongoing Maintenance

Launching a website is the beginning of its technical maintenance lifecycle. PHP, libraries, the content management system and server components all need ongoing attention.

Regular updates, verified backups and post-update functional checks help protect your business's digital presence. Include infrastructure security alongside content changes in your website maintenance plan.

Source: Official PHP security announcements and Windows package update, October 2026.