On October 21, 2026, the PHP development team released emergency security updates to address two critical vulnerabilities that could potentially allow attackers to run unauthorized code on affected web servers. Because PHP powers WordPress and many other business websites, this was an important security event for organizations of all sizes.
For businesses in Delray Beach, Palm Beach County, Broward County, and Martin County, the takeaway is simple: website security extends beyond WordPress updates. The PHP software running on the hosting server must also be maintained and patched.
What Were the Critical PHP Security Vulnerabilities?
The newly disclosed vulnerabilities were assigned CVE-2026-109618 and CVE-2026-109619. Both were rated critical, with a reported CVSS severity score of 9.2. They involve flaws in how PHP manages memory when processing web requests.
- CVE-2026-109618: An issue with out-of-memory handling can leave internal request data in an improperly initialized state.
- CVE-2026-109619: A separate issue can cause PHP to use internal state referencing memory that has already been freed.
Under certain conditions, these issues could enable unauthenticated remote code execution—meaning an attacker may be able to execute code without first logging in. The vulnerabilities are in PHP itself, not necessarily in a particular WordPress theme or plugin. Keeping WordPress updated is essential, but it does not replace patching PHP on the server.
Which PHP Versions Contain the Security Fixes?
PHP issued the following fixed releases on October 21, 2026:
- PHP 8.2.35 (or a later patched 8.2 release)
- PHP 8.3.36 (or a later patched 8.3 release)
- PHP 8.4.27 (or a later patched 8.4 release)
- PHP 8.5.12 (or a later patched 8.5 release)
Organizations running PHP 8.1 or earlier should not assume that an older version is protected. These versions no longer receive normal security releases from the PHP project. Some hosting or operating-system vendors may offer backported patches, but businesses should verify those fixes and plan a migration to a supported PHP branch.
It’s also important to note that PHP 8.2 reaches end of life on December 31, 2026. Even if its October security patch is installed, now is a good time to plan the next version upgrade.
TMD Technology Hosting Status: Patched Server Versions
Hosting status update — October 26, 2026: All websites hosted by TMD Technology Services are running patched server-side PHP versions that address these identified vulnerabilities.
Our response included reviewing PHP versions used in the hosting environments we manage, confirming the patched runtimes, and checking website functionality following necessary upgrades. Where a website needed to move to a newer PHP branch, compatibility testing helped reduce the risk of disruptions.
For business owners, this is one of the advantages of having an IT provider actively managing the technical side of a website. Server security, application compatibility, updates, and ongoing maintenance all deserve attention—not just the visible design of the website.
As with any security update, a patched PHP runtime resolves the identified PHP issues; it does not guarantee that a website is free from every possible vulnerability. WordPress core, plugins, themes, user access, and backups still require routine attention.
What Should Businesses Do if Their Website Is Hosted Elsewhere?
If another provider hosts your website, we recommend confirming the following:
- Check the active server PHP version. Confirm the version actually serving the website, rather than assuming the hosting control panel’s default is in use.
- Verify the security fix. Confirm a patched release or a documented vendor backport is installed.
- Plan upgrades for older sites. Unsupported versions may require application, theme, or plugin changes before they can move to a maintained PHP branch.
- Test site functionality. After updates, verify forms, customer portals, checkout processes, integrations, and other important features.
- Review backups and monitoring. Maintain recoverable backups and monitor for unusual behavior or unauthorized changes.
If your hosting provider says the server is protected, ask whether that confirmation applies to the specific PHP runtime your website is using. A server can offer newer PHP packages while an individual site remains assigned to an older version.
Security Maintenance Is an Ongoing Responsibility
High-profile vulnerabilities are a reminder that securing a website is not a one-time project. A reliable maintenance plan considers the hosting environment, WordPress updates, credentials, backups, vulnerability notices, and the compatibility of business-critical applications.
TMD Technology Services provides website design and management, business cybersecurity services, cloud backup solutions, and managed IT services to organizations throughout South Florida.
Have questions about your website’s PHP version or hosting security? Contact TMD Technology Services at 561-404-9251 to discuss a review of your website environment.
Technical references: PHP security releases, October 21, 2026 and Google Cloud’s PHP vulnerability guidance.
