Critical PHP Security Update: Update Now to Stay Protected

By Robert Mills

PHP is one of the most core and vital part of every website, every server and every application that depends on the PHP language. There is two major critical vulnerability detected and being released as patch work in PHP as an emergency security release.

So it’s important for any server, website or web application runs on PHP to prepare themselves to update as soon as possible.

Let’s delve into the details on what’s happening behind, why it should matters to you and  what you should do.

What Just Happened in PHP?

PHP Security team has made an immediate notice on 20th October regarding these two critical vulnerability they found which requires immediate fix in their upcoming security release (Next Day – 21st October).

• Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
• Severity: Both are rated CVSS v4.0 9.2 (critical)
• Why it is serious: The flaws are in the core of PHP, not in a single application or website. Any site, server or software that runs PHP could be exposed.
• Release Purpose: Encourage every user to prepare for the update as soon as they have released in their

What the Vulnerabilities Are:

The PHP team fixed two vulnerabilities in PHP itself, not in any single plugin or website:

• CVE-2026-109618: PHP runs out of memory can interrupt php even if left with partially initialized and treat broken data as valid.
• CVE-2026-109619: If PHP worker process a visitors request and left behind any freed space, the leftover memory will be then used again by same PHP worker for processing the next visitor request.

What the Code Will Affect (The Impact):

The primary threat of these vulnerabilities (dubbed “PHP2Shell”) is Unauthenticated Remote Code Execution (RCE).

• Complete Server Takeover: An attacker can exploit this flaw to execute arbitrary commands directly on the web server without needing any login credentials.
• Malware and Ransomware: Hackers can use this execution path to upload web shells, plant malicious software, or deploy ransomware across the hosting environment
• Data Theft: Attackers gain the ability to manipulate site databases, run their own code, secretly collect sensitive user information, lead to Website Defacement Attack, or pull the entire site offline

Immediate Fix: Update PHP

Update php version as follow,

How to Check Your PHP Version

1. On a Terminal/SSH: run this command.

php -v

2. On WordPress: go to Tools > Site Health > Info > Server. Your PHP version is listed there.

Compare your version with the table above to confirm that you are on a fixed release.

What If You Can’t Update Immediately?

If your server or website cannot be updated to the latest PHP version right away, the measures below can reduce your exposure. Please note that none of these settings is a complete mitigation, and updating PHP is still required.

For All Website Owners:

1. Take a full backup of your site so that you can restore it if required.

2. Upgrade from PHP 8.1 or earlier. These versions will not receive security patches, so you need to move to PHP 8.2 or higher.

3. Update any WordPress core, plugins, themes or custom code that do not support PHP 8.2 or higher. If an update is not available and you cannot fix the code yourself, remove it.

4. Delete unused and old .php files, and make sure only the intended front-controller files are executable.

5. Disable PHP execution in upload directories. For WordPress, deny PHP execution in wp-content/uploads.

6. Remove or avoid risky patterns such as eval(), assert(), preg_replace() with the /e modifier, dynamic include/require, system(), exec(), shell_exec() and proc_open().

7. Reduce exposure through PHP settings. In the MultiPHP INI Editor, switch to editor mode and set session.upload_progress.enabled = Off.

Additional Steps for WordPress Sites

1. Restrict access to wp-admin and wp-login.php by IP allowlisting or an access rule, where applicable.

2. Disable file editing in the dashboard by adding define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.

If Pointed Through Cloudflare:

1. Enable the proxy for all DNS records, so that traffic passes through Cloudflare before it reaches your server.

2. Where possible, use a custom rule with a Challenge action instead of a Block action, to reduce false positives.

3. Require Cloudflare Access, IP allowlisting or a managed challenge for /wp-login.php, /wp-admin, staging hosts and internal APIs.

After the Fix: Update and Verify

Once the fixed PHP release is available on your hosting server, follow these steps:

1. Put the site into maintenance mode while you update the PHP version.

2. Update PHP immediately to the fixed release for your version (see the table above).

3. If you own the server, restart PHP and the web server so that the update takes effect.

4. Confirm the version using the steps in “How to Change Your PHP Version“.

5. Make sure the site is fully operational after the update, then take it out of maintenance mode.

6. Rotate credentials if there is any sign of compromise. This includes WordPress admins, database users, SFTP/SSH keys, hosting panel logins, API keys and deployment secrets.

SeekaHost Hosting Customers:

If you are hosted on SeekaHost Hosting Servers, our server team is actively reviewing the applicable patches and security fixes and is proactively applying the necessary updates across our server infrastructure wherever required.

We continuously monitor security advisories and apply relevant server-level patches, updates, and fixes.