Critical PHP flaws are being used to break into websites

What happened, in plain English

PHP is the programming language that runs WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel apps and many custom sites. On October 21, 2026, the PHP team released fixes for two critical flaws. Details leaked a day before the fix came out, and attack attempts had already been spotted days earlier.

The flaws let someone on the internet run their own code on your web server without needing a password. That can mean a defaced or hijacked site, stolen customer data, hidden spam pages, or your server being used to attack others. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be exploited in real attacks.

Are you affected?

How to check your PHP version

1. WordPress: In your dashboard, go to Tools → Site Health → Info → Server. The PHP version is listed there.
2. Hosting control panel: In cPanel, look for "Select PHP Version" or "MultiPHP Manager." Other hosts usually list it under site or server settings.
3. Shared or managed hosting: Your host updates PHP for you, but you can't always see the exact patch level. Email their support and ask: "Has PHP on my account been updated to fix CVE-2026-109618 and CVE-2026-109619?" Get the answer in writing.

The full version number matters. For example, 8.3.36 includes the fix, but 8.3.30 does not. One exception: some servers get PHP from their Linux distribution, which can patch it without changing the version number. If that's your setup, ask your host or developer to confirm.

What to do

1. Update PHP to a fixed version, or confirm your host has. Prioritize anything that faces the public internet.
2. If you're on PHP 8.1 or older, you need to move to a supported version. That often means updating plugins, themes or custom code first, which is why many sites get stuck on old versions. CISA advises taking unpatched sites offline until they can be updated.
3. Back up first. Take a full backup of files and database before changing anything.
4. Look for signs of a break-in: admin users you don't recognize, new files you didn't add, visitors being redirected to strange sites, spam pages showing up in Google, or warnings from your host.
5. If you find anything suspicious, don't just patch and move on. Change passwords for hosting, the site's admin and the database, and have the site cleaned. Patching closes the door but doesn't remove anyone already inside.

What we do for clients

For sites on an Evergreen monthly plan, this is part of routine maintenance. We check the PHP version, apply or verify the available fix, look for common signs of a break-in, and tell you what we did and what we found. Not a client yet? We can do the same as a one-off job, or bring your site onto a monthly plan so updates like this are part of its regular care.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (updated October 26, 2026)
• CISA: Adds Two Known Exploited Vulnerabilities to Catalog (October 26, 2026)
• Tenable: php2shell frequently asked questions

This page is general information based on the public sources listed above, as of the review date. It isn't a security assessment of your site or app, and it can't tell you for certain whether you're affected. Details can change quickly, so check the official sources for the latest.