On 20 October 2026, the PHP security team warned about two critical security flaws. Both received a severity score of 9.2 out of 10. A security release is scheduled for 21 October at 14:00 UTC. CERT-EU, the European cybersecurity organisation, has issued an advisory as well.
PHP is a programming language that runs behind the scenes on many websites, including WordPress. It runs on the hosting company's computer, known as the server, where your website is hosted. According to W3Techs, 69.4% of websites whose server-side programming language was known used PHP on 19 October 2026. That explains why the warning matters to so many website owners. It does not mean that every website using PHP is affected.
What has actually been discovered?
Two serious security flaws have been reported in PHP. They have been assigned the reference numbers CVE-2026-109618 and CVE-2026-109619. CERT-EU says that a possible consequence is an attacker being able to run harmful commands on a vulnerable server over the internet. This assessment partly relies on third-party reports. The full technical details had not been officially published when the first warning was issued.
The official security release should clarify which PHP versions are affected and which versions fix the problems. Until those details are published, the initial warning alone cannot establish whether any particular website is vulnerable. Given the severity, hosting companies and server administrators should check their systems promptly.
What does this mean for WordPress websites?
WordPress uses PHP to build pages, process information and make website features work. Even if WordPress, the theme and every plugin are up to date, the server may still need a separate PHP security update. PHP is normally managed through your hosting account by the hosting provider or a technical administrator.
Automatic WordPress updates therefore do not cover every part of website maintenance. When a security problem affects PHP, the software running on the hosting server also needs to be checked. Whether your own site needs an update depends on its PHP version, the fixes already applied by the hosting company and the official details of these vulnerabilities.
For more about maintaining other parts of WordPress, see my article WordPress plugins: when do you have too many?.
How can you check your website's PHP version?
Sign in to your WordPress dashboard and open Tools, Site Health, Info and then Server. You should see the PHP version used by your website. Many hosting providers also display it in their control panel. If you cannot find it, your hosting provider can check it for you.
The version number alone does not confirm whether these particular security problems have been fixed. Some hosting providers apply security fixes without changing the version number shown in the control panel. Ask whether the server hosting your site is affected by the two reported flaws and whether the necessary security updates have already been applied or scheduled.
If a developer or agency looks after your website, it is worth checking who handles PHP updates. WordPress maintenance and server maintenance are sometimes covered by different services. Knowing who is responsible makes it easier to act when an urgent security update is announced.
What happens if your website needs updating?
Once the corrected PHP versions are available, the responsible administrator should check whether your server needs the update and apply the appropriate fix promptly. Avoid switching PHP versions without preparation. On older WordPress websites, a version change may affect existing themes, plugins or custom features.
A recent backup is important before a major change. After updating, check that the website still works, including contact forms, logins, payments and any booking tools. If there are signs that someone previously gained unauthorised access, the website and server should also be investigated.
Do websites built without WordPress face the same risk?
That depends on how the site was built. Other websites using PHP may be affected if they run a vulnerable version. Some websites do not use PHP at all. With Astro, for example, pages can be prepared in advance as regular website files, so visitors can view them without the server running PHP.
Pages built this way are not exposed to a PHP vulnerability when no PHP is running to serve them. The hosting, content management system and any connected services still need proper security maintenance. The right website technology depends on the features you need and how the site will be managed.
WordPress maintenance on the Costa Blanca
This warning is a good reason to check what your website runs on and who handles its updates. At Costa Wave Web, I help businesses on the Costa Blanca with WordPress maintenance, security checks, backups and technical problems. I can also review and maintain websites originally built by another developer.
Read more about WordPress websites, maintenance and support.
Sources
PHP Security Team, announcement of 20 October 2026
