A major PHP security alert has prompted website operators around the world to install urgent software updates after researchers uncovered two critical vulnerabilities in one of the internet’s most widely used programming languages.
The security flaws, disclosed on October 21, 2026, could allow attackers to execute malicious code on certain vulnerable servers without first logging in.
The discovery attracted international attention because PHP is used by a large proportion of websites, including sites built with popular content management systems such as WordPress.
However, security experts stress an important distinction: the widespread use of PHP does not mean every website running it has been hacked or can be exploited.
What Happened to PHP?
On October 21, the PHP project released emergency security updates addressing two critical vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Both received a critical severity rating of 9.2 under the Common Vulnerability Scoring System version 4.0.
The flaws affect internal memory handling and request processing in PHP. Under particular conditions, an attacker could exploit these weaknesses to execute code on a vulnerable server.
Such access could potentially expose sensitive data, allow unauthorized modifications or disrupt online services.
The PHP Foundation confirmed that fixes had been released and urged users to update their systems.
Does This Really Affect 70% of Websites?
Reports about the security alert have focused on the fact that PHP powers roughly 70% of websites.
That figure illustrates how widely the programming language is used, but it should not be interpreted as the percentage of websites successfully attacked.
Actual exposure depends on the PHP version, server configuration, application behavior and whether security updates have been installed.
Some websites may already be protected through patched software or additional security controls.
The practical message for website owners is to check their PHP version rather than assume they are either completely safe or automatically compromised.
Which PHP Versions Have Security Fixes?
According to the PHP Foundation, the following patched releases became available on October 21:
| PHP Branch | Patched Release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Administrators should follow the PHP project’s official advisories and their hosting provider’s guidance to determine which update is appropriate.
Running a supported, updated PHP release is particularly important for websites that handle customer accounts, payment information or other sensitive material.
What Is the Latest Update on October 23?
The Netherlands’ National Cyber Security Centre published a new assessment on October 23.
The agency said further investigation indicated that exploiting the two vulnerabilities was more complex than initially feared and that the likelihood of large-scale exploitation appeared lower than earlier estimates.
It also said that, at the time of its update, a reported possible exploit abroad had not been confirmed as successful.
Nevertheless, the agency continued recommending immediate installation of the available PHP security patches.
The distinction matters: a serious software vulnerability requires action even when widespread successful attacks have not been established.
Why WordPress Website Owners Should Pay Attention
WordPress is built using PHP, which means the underlying PHP runtime is an important part of its security.
But WordPress itself is not the same thing as PHP.
Updating WordPress themes and plugins helps address vulnerabilities in those components. It does not necessarily update the PHP software running on the hosting server.
Website administrators should therefore check both their WordPress installation and the PHP version provided by their hosting company.
A small business owner using shared hosting may not need to make the server change personally. Depending on the hosting service, the provider may manage or assist with PHP updates.
How to Check Your WordPress Website’s PHP Version
For many WordPress installations, the PHP version can be found through the administration dashboard.
Open Tools → Site Health → Info → Server and look for the PHP version information.
If the reported version is older than the relevant patched release, consult your hosting provider.
Before changing PHP versions, take a website backup and check that the installed theme and plugins support the intended version.
Major PHP version changes can affect compatibility, so production website owners should not make rushed changes without considering possible disruption.
Five Practical Security Steps for Website Owners
Check the PHP version. Identify whether the website runs a potentially affected version and confirm which security update is appropriate.
Apply official security patches. Follow announcements from the PHP project and your hosting provider.
Back up important website data. Maintain reliable copies of website files and databases before significant changes.
Review administrator access. Use strong passwords and enable two-factor authentication wherever available.
Monitor for suspicious activity. Watch for unfamiliar administrator accounts, unexpected file changes, unusual server behavior and warnings from hosting security systems.
These measures cannot guarantee complete protection against every cyberattack, but they can help reduce common risks.
What About Ordinary Internet Users?
People who browse websites do not generally need to update PHP on their own computers or phones because PHP typically runs on website servers.
However, ordinary users can take sensible precautions.
Avoid reusing passwords, enable multi-factor authentication on important accounts and be cautious about unexpected emails claiming that an urgent security update requires clicking an unfamiliar link.
Cybercriminals sometimes exploit fear surrounding major technology news to distribute phishing messages.
Users should obtain updates and account instructions directly from trusted official websites or applications.
The Role of Artificial Intelligence in the Discovery
The vulnerabilities also drew attention because artificial intelligence tools played a role in the research and coordinated response.
Security researchers and technology organizations used AI-assisted methods to identify weaknesses, analyze potential exploitation and support the development and testing of fixes.
The incident demonstrates how AI can help defenders discover serious security problems, while also raising concerns about how quickly similar tools might assist malicious actors.
For organizations operating critical online services, timely patching and coordinated security research remain essential.
What Happens Next?
The October 2026 PHP vulnerabilities have become an important reminder that widely used internet infrastructure requires continuous maintenance.
The PHP Foundation has released fixes, and national cybersecurity agencies continue encouraging website operators to install them promptly.
The latest assessment suggests large-scale exploitation may be harder than originally feared, but that does not eliminate the need to update vulnerable systems.
For website owners, the takeaway is straightforward: verify your PHP version, follow official security guidance and install the appropriate patched release as soon as practical.
