PHP Security Alert: What Business Website Owners Should Do
Understand the October 2026 PHP security alert, what website owners should ask their hosting team, and how to verify patches, testing, and follow-up.
Last week, PHP released emergency security updates for two critical vulnerabilities affecting the software that runs many websites and web applications. For a business owner, the immediate question is practical: does any part of your website or connected system use an affected PHP installation, and who is responsible for confirming the fix?
The FBI’s October 23 alert identifies CVE-2026-109618 and CVE-2026-109619 and urges organizations to check their exposure and update affected systems immediately.
This is a reason to verify the environment with the hosting or technical team. It is not evidence that every website has been compromised.
SMART takeaway
Confirm the PHP runtime was patched, not just the website dashboard.
Ask who manages PHP, which installations were checked, what patched package is active, and whether the team reviewed the environment for suspicious activity.
What happened with PHP?
On October 21, the PHP project published fixes for two vulnerabilities that can allow unauthenticated remote code execution. In business terms, an attacker could potentially run code on an affected server without first signing in.
PHP’s advisory covers installations serving web requests, including PHP-FPM and Apache with mod_php. The affected layer is the PHP runtime, so the investigation needs to reach the hosting or server environment.
A successful page load does not establish patch status. Ask for confirmation from the person who administers the actual PHP installation.
Does this affect WordPress and other business websites?
WordPress’s hosting requirements include PHP. That makes the underlying PHP environment relevant to a WordPress review, even when the business normally works only in the WordPress dashboard.
Start with an inventory of production sites, staging copies, custom applications, and vendor products that may bundle PHP. Identify the hosting provider and the responsible technical contact for each.
Do not assume that every website uses PHP or that a non-PHP public front end describes every connected service. Ask the implementer to document what is actually present.
Use the IT asset inventory guide and vendor access checklist to connect each system with an owner who can act.
Which versions received the October 21 fixes?
The PHP project lists these upstream releases for the two core vulnerabilities:
| PHP release branch | October 21 security release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Have the administrator check the current official advisory and release notices, including vendor backports and later updates.
As of October 26: PHP also published Windows package rebuilds with a separate Brotli dependency fix. The -1 package suffix does not change the PHP runtime version. Windows administrators should verify the complete package, not only the runtime number.
PHP also issued October 23 session-upload-progress guidance for an unusual configuration-dependent case. Ask the technical owner to review that follow-up rather than assuming the first update closes every question.
Why a plugin update or “automatic updates” message is not enough
Ask the provider to distinguish the PHP runtime from WordPress core, themes, plugins, and other application dependencies. Record which layer was updated and which remains to be checked.
The host may manage PHP, or the business’s administrator may own it. The service agreement and actual configuration should establish the responsibility.
For a concrete platform example, Laravel Forge’s advisory states that its automatic security updates do not patch PHP. It also explains that older backported packages may retain the same PHP version number and require checking the package revision.
That behavior is specific to the documented environment. Ask your own provider for equivalent evidence instead of assuming every hosting platform works the same way.
The website maintenance checklist helps keep application and hosting responsibilities connected.
What should a business ask its hosting or IT team?
Send a focused request with the site or application name and the responsible business contact. Ask the team to confirm:
- Whether PHP is present, including staging sites and bundled vendor products
- Which runtime, package source, and installed revision were reviewed
- What update was applied and how the active environment was verified
- Whether required services and long-running processes were restarted
- What suspicious-activity review was completed or remains open
- Who owns any unresolved exposure and the next decision
Keep the reply in the maintenance record. “Everything is updated” is less useful than a documented scope and result.
For Forge-managed applications, its guidance specifically calls for restarting long-running PHP processes after updating. Have the administrator follow the supported procedure for the actual platform.
What if the update cannot be applied immediately?
Escalate the decision promptly to the authorized technical and business owners. The FBI alert recommends taking affected systems offline if an immediate update is not feasible until they can be fully mitigated.
Have the team assess that recommendation for the identified system and coordinate the customer communication and recovery plan. Avoid treating a firewall rule, a healthy homepage, or an unverified workaround as proof that the issue is resolved.
Do not copy server settings from a social-media post into a production environment. The responsible administrator should use the current vendor guidance and document any temporary measures and remaining risk.
Verify the customer journey after the change
Plan an appropriate backup and recovery arrangement while coordinating the urgent update. Once the team reports completion, test the business tasks the website supports.
Check the relevant contact forms, sign-in, booking, checkout, uploads, integrations, and scheduled jobs. Use authorized test data and record what passed.
The backup recovery-testing guide helps establish a usable recovery path. The automation error-handling guide helps review failed or repeated downstream actions.
If there are signs of compromise, follow the incident response plan. The FBI advises preserving web-server and PHP logs and reporting suspected compromise through the appropriate channels. Patching and investigating possible prior access are separate tasks.
How SMART Solutions can help
SMART Solutions provides website development and improvements and cybersecurity services. Contact our team to review the website, hosting responsibilities, and appropriate support scope.
Start by identifying the systems your business uses, the responsible providers, and the authorized management scope. Keep the assessment and any completed remediation documented.
For your next provider conversation, start with three questions: Do we use affected PHP? Who owns the update? What evidence confirms the active environment was checked?