Skip to main content
Elliott Digital

PHP security alert

Is your website affected by the PHP security alert?

Many hosting companies install these updates for their customers, so your website may already be protected. This check helps you work out where you stand, and what to ask if you're not sure. We don't scan or connect to your website.

What's going on?

PHP is the software behind lots of websites, including most WordPress sites. In October 2026, two serious flaws were found that could let a stranger take over the server your website runs on. Fixed versions are out now, and every website that uses PHP needs the fix.

If your hosting company manages your server for you, they've probably handled it, but it's worth confirming. If you look after your own server, or your host only provides the space, the update is more likely to be down to you or your web person.

Don't know the answers? That's fine. Pick "I don't know" and we'll give you a ready-made message to send your hosting company.

Your answers stay in your browser and disappear when you refresh. Nothing is sent unless you download a file or choose to send us a request. Please don't type passwords or security codes.

Most WordPress, Joomla and Drupal websites use PHP. Your hosting company can tell you.

Only used to label your report. We don't visit or scan it.

Your to-do (optional)

Answer what you can, then select Show me what to do. If you change an answer, select it again.

If your website does need updating

  1. Find every website you have that uses PHP, including any separate blog, shop or test site.
  2. Take a backup of the website first.
  3. Install the fixed PHP version, or get your hosting company to confirm in writing that both fixes are in place.
  4. Check the website still works properly afterwards.
  5. Keep written confirmation for every website.
  6. If it can't be updated quickly, follow the official advice below. This may mean taking the website offline for a while.
  7. Updating closes these two flaws but doesn't prove nobody got in before, so ask your web person to check for signs of a break-in.
Contact Elliott Digital for help

Has your hosting provider protected your website? We can help you find out.

With your permission, we'll check with your hosting company or look at your hosting account, confirm which PHP version your website really runs, and tell you plainly whether anything needs doing. If your host has already sorted it, we'll tell you that. If it does need updating, we can arrange it.

Nothing is sent until you select Send PHP help request, and your answers above are only included if you tick the box.

Your request

Total request length: 98 / 5000 characters.

We use your enquiry to assess and respond to your request, not to add you to a marketing list. Please read the privacy notice. Do not include passwords, security codes or unnecessary sensitive information.

Prefer email, or having trouble submitting? Email Elliott Digital. You can attach your downloaded results.

For your web person: technical details and official sources

CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated command execution on servers running PHP for web requests. The PHP team advises urgent updates for all PHP installations serving web requests. The upstream fixes are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older branches require vendor backport evidence or an upgrade to a supported branch.

A website address alone cannot establish vulnerability. Missing PHP headers do not establish PHP is absent. Command-line PHP may differ from the runtime serving web requests. Vendors may backport fixes into older-looking package versions. A patched version does not prove a website was never compromised.

Technical worklist

  1. Inventory all PHP web runtimes, pools, containers and bundled products.
  2. Verify the exact running packages against official vendor fixes for BOTH CVE-2026-109618 and CVE-2026-109619, including backports.
  3. Back up files, databases and configuration, and establish a tested recovery route.
  4. Test application compatibility with the patched version.
  5. Arrange urgent maintenance and apply the appropriate supported update.
  6. Restart or replace relevant workers and containers as required.
  7. Verify the live web runtime and test important website functions.
  8. Record package/advisory evidence and completion for every runtime.
  9. Follow official mitigation/offline guidance if immediate patching is impossible.
  10. Assess for compromise where appropriate; patching does not prove no previous compromise.

NCSC PHP security alert · PHP security advisory and temporary mitigations · PHP official releases

PHP advisory for CVE-2026-109618 · PHP advisory for CVE-2026-109619

If immediate updating is impossible, follow the official temporary mitigation guidance with your administrator. Mitigations are incomplete; NCSC advises considering taking systems offline if they cannot be mitigated promptly, and assessing for compromise.

Version rules checked: 21 October 2026. Recheck official guidance before maintenance; this assessment covers these two CVEs only.