What are the impacts and risks of PHP vulnerabilities, and how should websites respond?
According to the supplied reports from October 2026, two critical PHP core vulnerabilities could allow attackers to execute arbitrary code on website servers without logging in. A compromise could expose customer data and harm search visibility. Website teams should first confirm their PHP version and hosting environment, then install the applicable patches. If immediate protection is not possible, they can consider temporarily isolating the site or taking it offline. A firewall is no substitute for patching, and checks for an existing compromise are still necessary after updating.
The risk lies in the PHP core, not just website plugins
The supplied material identifies CVE-2026-109618 and CVE-2026-109619 as use-after-free memory vulnerabilities that attackers could trigger through specially crafted multipart/form-data requests. Proof-of-concept code is already available. This is not merely a matter of website features malfunctioning: unauthorized parties could potentially execute code on the server.
According to the reports’ account of PHP’s explanation, all PHP installations that handle web requests are at risk, with Apache environments using mod_php facing the highest risk. Demonstrated attacks can even execute before the website’s own code starts running. Checking plugins alone is therefore insufficient, and not using mod_php does not mean a site is safe.
Confirm the version, then ask the hosting provider to patch PHP
Systems such as WordPress, Drupal, Joomla, and Magento commonly use PHP and should be included in the inventory. In WordPress, the PHP version can be found under “Tools > Site Health > Info > Server”; for other systems, check according to the actual environment.
- The report dated October 21, 2026, lists PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the fixed versions. When using vendor-provided updates, confirm that they include both patches.
- Updating WordPress or its plugins does not update PHP. Ask the hosting provider to install the patches. Even if the control panel lets you switch versions yourself, confirm that the selected version includes the fixes.
- According to that report, PHP 8.1 and earlier versions no longer receive regular official support. Back up first and schedule an upgrade. The limited source-code patches provided for 7.4, 8.0, and 8.1 do not mean that ongoing support has resumed.
If immediate patching is not possible, assess isolation and maintenance pages
The reports quote PHP as saying that no workaround fully addresses these two vulnerabilities. A web application firewall may block some attacks, but it should not be treated as a completed fix. If attackers can connect directly to the origin server, they may bypass inspection, so all traffic must pass through the firewall.
If the site still cannot be protected immediately, discuss temporary isolation or taking it offline with the hosting provider. While the site is offline for patching, the web server or CDN can serve an HTTP 503 maintenance page to indicate a temporary service interruption without relying on PHP. This is a risk-management option, not a requirement for every website using PHP to shut down.
Completing the patch does not mean a compromise has been removed
Patches provide protection only once installed, and they do not remove an existing compromise. Follow-up checks should look for web shells, unfamiliar administrator accounts, and unexpected changes to PHP files. For example, an unfamiliar administrator account should not be left uninvestigated simply because the version has been updated. Website teams should also monitor suspicious activity and agree in advance with their hosting provider on responsibilities for emergency patching and taking the site offline if it cannot be protected.
PHP vulnerabilities: perspectives from across the web
Does a government website going offline mean it has been hacked?
Not necessarily. Reports from October 2026 stated that websites belonging to the Dutch parliament, a Dutch cybersecurity agency, and the Finnish government, among others, went offline before patches were released. Finland’s shutdown was described as a precaution rather than the result of a compromise. At the time, the EU’s Computer Emergency Response Team and the UK’s National Cyber Security Centre also advised considering temporary isolation or shutdown if immediate protection was not possible. Whether to take a site offline still depends on its individual environment.
What do the severity scores and reports of attacks on these two vulnerabilities mean?
According to reports from October 2026, both vulnerabilities had a CVSS v4.0 severity score of 9.2, and proof-of-concept code was already available. Other reports stated that hackers had made millions of attack attempts. This information indicates that the issue is being taken seriously, but it does not establish that any particular website has been attacked or compromised. Website teams still need to assess their own environments and monitor suspicious activity.
References
- PHP 爆漏洞多國Website急搶修，駭客嘗試攻擊數百萬次www.mobile01.com — Discusses: What do the severity scores and reports of attacks on these two vulnerabilities mean?
- Critical PHP Core Vulnerabilities Affect Websites, Including WordPresswww.searchenginejournal.com · 2026-10-21T13:46:10+00:00 — Discusses: Does a government website going offline mean it has been hacked?; What do the severity scores and reports of attacks on these two vulnerabilities mean?
Join the discussion 0 comments
What are you working through? Share a question or experience and let’s find the next step.
No comments yet. Start the conversation.