Two critical security vulnerabilities were disclosed in PHP on 21 October 2026. PHP powers many websites, including WordPress, and these flaws could allow attackers to compromise an affected website without logging in.
Read the official PHP advisory.
If you are hosted with IN2Tech’s Premium Web Hosting service, no action is needed. All our services are already patched and protected against these vulnerabilities.
If your website is hosted elsewhere, please:
- Contact your website developer to confirm whether it uses PHP and arrange necessary updates and compatibility checks.
- Contact your hosting provider’s support team to confirm fixes for CVE-2026-109618 and CVE-2026-109619 are installed and active.
- Don’t rely on a control panel showing “PHP 8.4” alone. The full patch version matters. Fixed releases include PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or vendor packages containing equivalent security fixes.
The PHP software on the hosting server must also be patched. Updating WordPress, themes and plugins remains important.
Unsure who manages your website or hosting? Contact IN2Tech for help identifying the right next steps.
To learn more about these vulnerabilities, see the announcement from PHP.