Ceylon Servers Logo
Back to Blog

Important PHP Security Update: What Website Owners Need to Know

October 23, 2026 Updated Oct 23, 2026
Important PHP Security Update: What Website Owners Need to Know

Last Updated: 23 October 2026

PHP is an essential part of many websites, including WordPress sites, online stores, business websites, and custom web applications. Keeping PHP up to date is therefore an important part of maintaining a secure hosting environment.

On 21 October 2026, the PHP development team released security updates to address two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities may allow attackers to execute malicious code on affected servers without logging in. They can also expose sensitive information stored in PHP process memory. Both vulnerabilities have a critical severity rating, with a CVSS v4.0 score of 9.2. Website owners and server administrators should review their hosting environments and ensure that the necessary security updates have been applied.

What Is the PHP Security Issue?

The vulnerabilities affect the way PHP handles memory and internal application requests. If an affected PHP installation is successfully exploited, an attacker may gain the ability to run malicious code on the server. The two issues are:

CVE-2026-109618 – Memory Handling Vulnerability

This issue occurs when PHP encounters an out-of-memory condition while processing a request. Under certain circumstances, internal request data may not be fully initialized before PHP attempts to clean it up. This can result in memory corruption and potentially allow remote code execution.

CVE-2026-109619 – Internal State Management Vulnerability

This issue involves internal request data that may remain accessible after the memory associated with it has been released. A later request handled by the same PHP worker may use this outdated state before it is properly reset, potentially creating another path to remote code execution. These are vulnerabilities in the PHP runtime itself. As a result, updating only a website's themes, plugins, or application code does not resolve the underlying issue.

Which Websites Could Be Affected?

Any website or application running a vulnerable PHP installation that processes web requests should be assessed. This may include:

  • WordPress websites and other content management systems.
  • E-commerce websites and online shopping platforms.
  • Business websites and custom-developed applications.
  • Websites built with PHP frameworks such as Laravel.
  • PHP applications hosted on shared hosting, VPS, or dedicated servers.

The risk is related to the PHP runtime, not a particular hosting provider or website platform. Even a website that appears to be functioning normally may require a security update. For this reason, website owners should not wait for visible errors or suspicious activity before checking their PHP environment.

Which PHP Versions Need to Be Updated?

The PHP development team has released fixes for the following versions:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

These releases address both CVE-2026-109618 and CVE-2026-109619.

Earlier releases in the affected PHP branches should be updated to the appropriate fixed version. PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project, although some vendors provide security fixes for selected older branches. If your website relies on an older PHP version, check with your hosting provider or software vendor to confirm whether an applicable security patch is available.

It is also important to remember that the PHP version displayed in a hosting control panel may not be enough to confirm that the vulnerability has been resolved. Some vendor-maintained packages use backported security fixes without changing the main PHP version number. For the official technical details, visit the PHP security advisory .

What Should Website Owners Do Now?

Taking a few practical steps can help ensure that your website remains protected and continues to operate reliably.

1. Check Your Website's PHP Version

Find out which PHP version your website uses. If you manage multiple websites, check each one because different domains and applications may use different PHP versions.

2. Make Sure Security Updates Are Applied

Update vulnerable PHP installations to the appropriate fixed release, or confirm that your hosting provider has applied an applicable vendor security patch. If you use a VPS or dedicated server, you or your server administrator may need to manage these updates directly. For shared hosting customers, system-level PHP updates are generally handled by the hosting provider. Contact the provider if you are unsure whether the required security fixes have been applied.

3. Keep Your Website Software Updated

Although this vulnerability affects PHP itself, keeping your content management system, themes, plugins, and application dependencies updated is also important. Regular updates help reduce the risk of other known security issues affecting your website.

4. Keep a Recent Backup

Before making major server or PHP changes, ensure that you have a recent backup of your website files and databases. After an update, test important website features to confirm that everything is working correctly. If you suspect your site was compromised before the update, investigate the incident rather than assuming the security patch has removed any malicious changes.

5. Monitor Your Website for Unusual Activity

Look for unexpected errors, unauthorized file changes, unfamiliar processes, or unusual server activity. If you manage your own server and suspect a security incident, investigate it promptly. Applying a patch prevents exploitation of the fixed vulnerabilities but does not automatically remove malicious changes that may already exist.

Do cPanel and Plesk Users Need to Take Action?

Website owners using cPanel or Plesk should follow the security guidance published by the relevant control panel provider. The required updates may depend on the installed PHP packages, operating system, and control panel version. Administrators should check the applicable official instructions and verify that the relevant components have been updated. Simply changing the PHP version selected for a website does not necessarily mean that every affected server component has been patched. For detailed instructions, refer to the official documentation linked under “More Information” below.

Does Having an SSL Certificate Keep Your Website Safe From This Issue?

An SSL/TLS certificate helps protect information exchanged between a website and its visitors by enabling an encrypted HTTPS connection. However, an SSL certificate does not fix vulnerabilities in PHP or other server software. A website can have a valid SSL certificate and still run an outdated PHP version that is vulnerable to attack. HTTPS protection and server security address different risks, so both should be maintained.

To improve your website's overall security, use HTTPS, keep the server software updated, maintain current application software, and follow the security recommendations provided by your hosting provider.

How Ceylon Servers Can Help

At Ceylon Servers, we understand the importance of maintaining a secure and reliable hosting environment for websites and online businesses. If you are using our hosting services and are unsure which PHP version your website uses or whether you need to take any action, contact our support team for guidance.

Customers managing their own VPS or dedicated servers should ensure that PHP and other server components are maintained according to the relevant software vendor's recommendations. Regular updates, appropriate backups, and timely security checks can help reduce unnecessary risks and keep your website running smoothly.

Final Thoughts

CVE-2026-109618 and CVE-2026-109619 highlight the importance of keeping the software behind a website up to date. These critical PHP vulnerabilities may allow unauthenticated attackers to execute malicious code on affected systems. Website owners should check their PHP installations, apply the appropriate security updates, and contact their hosting provider if they are unsure whether their environment is protected.

Maintaining website security is an ongoing responsibility. By keeping your server software and applications updated and following trusted security guidance, you can help protect your website, your visitors, and your business.

More Information

For official security details and platform-specific instructions, refer to the following resources:

Share: