Critical PHP vulnerability (October 2026): what WordPress site owners need to do

On 21 October 2026 PHP released fixes for two critical security flaws, and the UK's National Cyber Security Centre told organisations to act immediately. PHP runs WordPress, WooCommerce and a large share of the web, so if your website is built on WordPress, this affects you. Here's what has happened, how to check your site and what to do,.

What has happened?

PHP is the programming language that runs on the web server behind most WordPress sites. It builds each page before it's sent to your visitor's browser. Two newly fixed flaws could let an attacker push PHP into running out of memory in a way that corrupts it, and under certain conditions use that to run their own commands on the server, without needing to log in.

• CVE-2026-109618. When PHP runs out of memory part-way through a request, it can be left holding half-prepared data that it later treats as valid.
• CVE-2026-109619. Data that belongs to one request can outlive it and be picked up by the next request handled by the same PHP process.

PHP rates both as Critical, 9.2 out of 10. The NCSC published its alert on 21 October and updated it on 22 October. The primary sources are the NCSC notice and PHP's own advisories, RCE via OOM corruption and RCE via stale global state.

Is my website affected?

If your site runs on WordPress, almost certainly yes, until whoever looks after your server updates PHP. The same goes for WooCommerce shops, Joomla, Drupal and Magento, and for plenty of custom-built sites, booking systems and tools that run PHP on the server. Every version of PHP before the fixed releases is affected, not only old ones.

Sites that don't run PHP aren't affected. Static sites, including the hand-built sites we make, are served as finished files and run no PHP at all. Website builders such as Wix, Squarespace and Shopify run their own platforms, so there's nothing for you to update there.

How to check your PHP version

There are three quick ways to find out:

1. In WordPress: go to Tools, then Site Health, open the Info tab and expand Server. The PHP version is listed there.
2. In your hosting control panel: cPanel, Plesk or your host's own dashboard usually shows it under "PHP version" or "PHP selector".
3. Ask: email your host or developer and ask, "Which PHP version is my site on, and has it been updated for CVE-2026-109618 and CVE-2026-109619?"

Then compare it with the fixed versions:

Some hosts apply security fixes to their own builds of PHP without changing the main version number. If your version looks older than the table, ask your host whether the fix has been applied before assuming the worst.

What to do now

The NCSC's advice, in plain terms:

1. Find everything that runs PHP. Not just your main website: old sites, staging copies, booking systems and anything else on a server, starting with whatever is public.
2. Update PHP to a fixed version. On most shared and managed hosting, your host does this or offers a one-click switch. Check that WordPress, your theme and your plugins still work afterwards, ideally on a staging copy first.
3. If you can't update straight away, the PHP Foundation has published temporary mitigations, which your host or developer can apply.
4. If neither is possible quickly, the NCSC says to consider taking the site offline until it's fixed.
5. Check that nobody got in before you patched. Look for admin users you don't recognise, files you didn't add, unexpected redirects or spam pages, and changes to your theme or plugins. If you aren't sure how, get help.
6. Keep watching for updates, including from software and devices that bundle PHP. The Dutch NCSC keeps a list of affected products.

What we've done for our clients

Every WordPress and PHP site we look after has already been updated to a patched version of PHP. We did each one ourselves, checked the version afterwards, and checked each site for signs of compromise. The hand-built sites we make don't run PHP, so they were never affected.

If you're a client, you don't need to do anything, and you'll hear from us directly. If you have a question about your own site in the meantime, get in touch and we'll tell you exactly what was done.

If you aren't one of our clients

Ask whoever looks after your site the question above, and expect an answer with a version number. If nobody looks after it, or you aren't sure, get in touch and we'll happily take a look. Keeping PHP, WordPress and plugins up to date is part of our hosting and support, and comes as standard in both monthly plans if we host your site.

We look after WordPress sites, so we aren't neutral. Everything in this guide is something you or your host can do without us.

Common questions