Hosting your WordPress site with Vertex Digital? You’re already covered. Our servers have been updated to the patched version of PHP. There is nothing you need to do, and your site, its data and your visitors are protected. If you have any questions, just reach out. That’s what we’re here for.
On October 21, 2026, the team behind PHP released emergency security updates for two critical vulnerabilities. PHP is the programming language that powers WordPress, and by extension a large share of the websites on the internet. Both flaws could allow an attacker to take control of a web server, and in some setups that attack requires no login at all.
If your website runs on WordPress (or any other PHP software), this affects you. The good news is that the fix is available. The question is whether someone has actually applied it to your server. Below, we break down what happened in plain language, how responsible hosting companies responded, and what you should do if you’re not sure where your site stands.
The Two PHP Vulnerabilities, in Plain Language
Both vulnerabilities are rated critical, with a CVSS severity score of 9.2 out of 10, according to the PHP Foundation. They live in PHP’s memory management and error handling, which nearly every page request touches.
| Vulnerability | What it is | Why it matters |
|---|---|---|
| CVE-2026-109618 | Remote code execution through memory corruption. When a request hits PHP’s memory limit at exactly the wrong moment, PHP can hold on to half-built data and later treat it as valid. | On Apache servers using mod_php, an attacker can trigger it without logging in, before your website’s own code even runs. Full takeover was demonstrated on default settings. It was also confirmed on PHP-FPM setups. |
| CVE-2026-109619 | Remote code execution through leftover memory. A fatal error at the wrong point can leave PHP pointing at memory from a previous visitor’s request. | A later request can reuse that freed memory. Researchers demonstrated a full takeover of a real-world application on Apache with mod_php. |
Which PHP versions fix it?
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any server running an older build of those branches is exposed until it is updated.
Sites still running PHP 8.1 or older are in a worse position. Those versions are past end of life and do not receive security fixes at all, so the only real fix is to upgrade to a supported version.
How were they found?
The root cause was first spotted during a 2024 security audit funded by the PHP Foundation, but no practical attack was known at the time. In 2026, a wave of security researchers, several of them using AI-assisted tools, independently found working attacks. The PHP Foundation reports it has published 15 security advisories since July 1 alone. Expect this pace to continue. More scrutiny means more fixes, and more fixes mean servers need to be patched more often.
Why This Release Was Different: A Leaked Embargo
Normally, serious security fixes follow a quiet, coordinated schedule. Hosting companies and Linux distributions get advance notice, prepare their updates, and everyone patches at the same time the public finds out. That window is what keeps attackers from getting a head start.
This time, the schedule fell apart. In the 24 hours before the planned release, the vulnerability IDs appeared online early, a researcher accidentally published a video of a working attack, and at least one vendor shipped patched software ahead of the agreed time. The PHP project moved the official release up by a full day, from October 22 to October 21, to limit the damage.
The result: attackers knew something big was coming while many servers were still unpatched. Hosts that were watching closely had hours, not days, to respond.
How Responsible Hosts Responded
Managed WordPress host WP Engine published a detailed account of its response, and it is a useful benchmark for what good hosting looks like during an event like this:
- Shortly after midnight on October 21: firewall (WAF) rules were switched on to detect and block attack attempts.
- By 3:00 AM: temporary PHP configuration changes were rolled out across all servers while waiting for the official patch.
- Once the patch arrived: it was tested and deployed to every customer site.
In the 24 hours that followed, WP Engine’s firewall blocked more than one million requests tied to these vulnerabilities. That number matters. It shows attackers were actively scanning for vulnerable servers almost immediately. WP Engine reported no successful attacks against its customers, who did not need to lift a finger.
That is what managed hosting is supposed to deliver: someone awake at 3:00 AM so you don’t have to be.
Vertex Digital Hosting Clients: What This Means for You
Nothing changes for you, and there is no action required. If your WordPress site is hosted with Vertex Digital, the PHP update has already been applied to our servers. This is exactly the kind of work your hosting plan covers, quietly and in the background.
Every Vertex Digital WordPress hosting plan includes:
- Server-level security updates, including PHP patches like this one, applied as soon as they are released and tested
- Automatic WordPress core and plugin updates, closing the other common doors attackers use
- 30 days of daily backups, so there is always a clean copy to fall back on
- Free SSL, plus domain and DNS management
- A real person to call, right here in Sarnia-Lambton, not a ticket queue in another time zone
If you would like confirmation of the PHP version your site is running, send us a note and we will tell you.
Not Using Managed Hosting? You May Be on Your Own
Here is the uncomfortable truth. A lot of small business websites sit on hosting where nobody is responsible for security except you. That usually looks like one of two setups.
Budget shared hosting and “unmanaged” plans
Low-cost hosting is often cheap for a reason. Many plans provide the server and little else. PHP updates may happen on the host’s schedule, which can be days or weeks after a critical release. Some hosts leave you on an outdated PHP version until you log in and switch it yourself. If something goes wrong, the support answer is often “that’s outside the scope of your plan.”
During an event like this one, that gap matters. Attackers were scanning for vulnerable servers within hours. A site that waits a week for its host to get around to patching is a site that spent a week exposed.
Managing your own server (VPS, cloud or dedicated)
Running your own server gives you full control. It also hands you full responsibility, and that responsibility never takes a day off. To stay ahead of a release like this one, someone has to:
- Watch for CVE announcements across PHP, the web server, the operating system, the database and every piece of software in between.
- Understand which ones apply to your exact configuration (mod_php or PHP-FPM, which PHP branch, which modules).
- Apply mitigations immediately when a fix is not yet available, often in the middle of the night.
- Test and install the patch without breaking the live website.
- Monitor for signs of compromise afterward, because by the time the patch lands, attackers may already have tried.
Now multiply that by the steady stream of updates. The PHP Foundation alone has published 15 security advisories since July. Add Apache or Nginx, MySQL, OpenSSL, the Linux kernel and WordPress itself, and keeping up becomes a part-time job. For a business owner whose real job is running the business, it can quickly become a nightmare. When it is missed, the cost is not just a hacked website. It is lost sales, a blacklisted domain, damaged customer trust and, in some cases, exposed customer data.
The bottom line
Cheap or self-managed hosting is not free. The cost is just deferred, and it tends to show up at the worst possible moment. Managed hosting moves that responsibility to a team whose job is to watch for these things.
What To Do Right Now if Your Site Is Hosted Elsewhere
- Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server. You should see 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer). Anything on 8.1 or older needs an upgrade, not just a patch.
- Ask your host directly. Email or call and ask: “Have you applied the October 21 PHP security release for CVE-2026-109618 and CVE-2026-109619?” A good host will answer quickly and clearly.
- Update WordPress, themes and plugins. Patching PHP closes this hole, but outdated plugins remain the most common way WordPress sites are compromised.
- Confirm you have a recent, off-site backup. If the worst happens, a clean backup is the difference between an inconvenience and a disaster.
- Plan ahead for PHP 8.2. Security support for PHP 8.2 ends at the end of 2026. If your site depends on it, start planning the move to a newer version now.
- If you manage your own server, apply the update immediately and review your logs for unusual errors or crashes since October 20.
Frequently Asked Questions
Is my WordPress site affected by the October 2026 PHP vulnerabilities?
If your site runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, it is potentially exposed until your host or server administrator applies the update. Sites on PHP 8.1 or older are exposed with no patch available.
Do I need to do anything if I host with Vertex Digital?
No. Vertex Digital has already updated PHP on our hosting servers. Your site is protected, and no action is needed on your part.
Can a WordPress security plugin protect me from this?
Not fully. These flaws live in PHP itself, below WordPress. In some configurations an attack can trigger before WordPress or any plugin loads. Server-level patching is the real fix.
How do I find out which PHP version my site uses?
Log in to WordPress and open Tools > Site Health > Info, then expand the Server section. You can also ask your hosting provider.
What is the difference between managed and unmanaged hosting?
With managed hosting, the provider handles server security, updates, backups and monitoring for you. With unmanaged hosting, you get the server, and keeping it secure is your responsibility.
Not Sure Where Your Site Stands? Let’s Find Out.
If your website is hosted somewhere else and you are not sure whether it has been patched, we are happy to take a look. Vertex Digital is a small web agency serving Sarnia-Lambton and Southwestern Ontario, and we can check your PHP version, review your hosting setup, and give you a straight answer on whether your site is at risk.
If moving to managed hosting makes sense, we will handle the migration for you, so the next critical update is something you read about after it is already taken care of.
Contact Vertex Digital for a free hosting check
Sources
- Today’s PHP Security Release and How We’re Strengthening PHP Security, The PHP Foundation, October 21, 2026
- PHP Vulnerability Update, WP Engine, October 22, 2026