PHP Security Release October 2026: UK Website Checklist

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws that can allow unauthenticated remote code execution. UK businesses running WordPress, WooCommerce, Laravel or any PHP site should confirm today that their host has moved them to one of those versions, or to a vendor build carrying the fix.

This affects a very large share of small business websites, because PHP runs most mainstream content management systems. The good news is that the fix is a routine version update. The risk comes from assuming someone else has already done it.

Key takeaways

On 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws rated CVSS v4.0 9.2.
PHP says there are no complete mitigations and updating is the only safe choice.
The NCSC advises finding every PHP installation, updating, and taking systems offline if you cannot patch or mitigate quickly.
PHP 8.1 and older get no official releases, and PHP 8.2 reaches end of life on 31 December 2026.

What happened

The PHP security team gave unusual advance warning. On 20 October 2026 it announced a release "scheduled for Wednesday, 21 October 2026 at 14:00 UTC", addressing "two critical vulnerabilities, both rated CVSS v4.0 9.2". It reserved the right to release earlier if details leaked or exploitation appeared.

The security advisory published on 21 October lists the two issues:

CVE	Description in the PHP advisory
CVE-2026-109618	Remote code execution via out-of-memory corruption
CVE-2026-109619	Remote code execution via stale global state

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's wording is blunt: "There are no complete mitigations, updating is the only safe choice."

The advisory does list some partial measures, such as lowering post_max_size and turning off session.upload_progress.enabled, but warns that they "reduce exposure to specific attack paths but do not make an installation safe".

The NCSC's alert

The UK's National Cyber Security Centre published an alert on 21 October 2026, updated on 22 October. It says "organisations using any version of PHP are affected" and sets out a clear order of work: find every PHP installation, update, apply PHP's temporary mitigations if you cannot update, and take the system offline if mitigations are not possible quickly. It also asks organisations that cannot patch straight away to check for signs of compromise and backdoors, using an NCSC-assured incident response provider if needed.

The NCSC's own alert does not say exploitation has been seen. New Zealand's NCSC, in its alert of 22 October 2026, says it "is aware of reports of active exploitation". Treat this as a live issue rather than a theoretical one.

Older PHP versions

PHP's advisory states that "PHP 8.1 and older no longer receive updates from the PHP project". The security team published source backports for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship their own patched builds. The PHP 8.2.35 notice also confirms that PHP 8.2 "reaches end of life on 31 December 2026 and will receive no further security fixes after that date".

Who this affects in the UK

Small businesses on shared or managed hosting. Most hosts patch PHP centrally, but many control panels let each site pick its own PHP version. A site pinned to an old version may stay unpatched.
WordPress and WooCommerce owners. A WordPress core update does not change your server's PHP version. You need the PHP fix from your host.
Agencies and freelancers who manage client servers, VPSs or containers. Docker images and custom builds need rebuilding with the fixed version.
Anyone running appliances or software that bundles PHP. The NCSC specifically notes that third-party products may contain PHP, so watch vendor advisories too.

If you hold Cyber Essentials, remember that the scheme expects high-risk and critical updates within 14 days, as covered in our Cyber Essentials 2026 changes guide.

Practical checklist

Find your PHP version. In cPanel, Plesk or your host's dashboard, look for "Select PHP version" or "MultiPHP Manager". In WordPress, go to Tools, then Site Health, then Info, then Server.
Compare it with the fixed versions. You want 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Note that some distributions patch without changing the version number, so ask your host to confirm in writing if the number looks old.
Ask your host directly. A one-line support ticket ("Have you deployed the 21 October 2026 PHP fixes for CVE-2026-109618 and CVE-2026-109619 on my account?") gets a clear answer.
Move off PHP 8.1 or older. Test your site on PHP 8.3 or 8.4 in a staging copy first. Plan to leave 8.2 before 31 December 2026.
Restart PHP services. On your own servers, restart PHP-FPM or the web server after updating so the new binaries are actually in use.
Take a backup before and after. Our website backup guide covers what a usable backup looks like.
Check for signs of compromise. Look for unknown admin users, new PHP files in upload folders and odd scheduled tasks. Our guide to the signs your website was hacked lists more symptoms.
Stop advertising your version. Servers sometimes reveal the PHP version in an X-Powered-By header. Our free security headers checker and HTTP status checker help you review what your server sends.
Confirm the site is back up. After the update, run your homepage and checkout through the website down checker.

While you are in there, it is a good moment to look for other easy wins attackers use, such as exposed .env and .git files, and to work through our WordPress security checklist. Make It Flow's free tools for IT services and web development teams can help you check client sites in bulk.

FAQ

Does updating WordPress fix the PHP vulnerabilities?

No. The flaws are in PHP itself, the language your server uses to run WordPress. Updating WordPress core, plugins or themes is good practice, but it does not change the PHP version. You need your host or server administrator to install PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor build with the fix.

How do I know if my host has patched PHP?

Check the PHP version shown in your control panel or in WordPress Site Health. If it is not one of the fixed versions, ask your host. Some Linux distributions backport fixes without changing the visible version number, so a written confirmation from support that the 21 October 2026 fixes are deployed is the most reliable answer.

I am still on PHP 7.4 or 8.1. Am I protected?

Not by the PHP project's releases. PHP 8.1 and older no longer receive official updates. The security team published source backports, and some vendors ship patched builds, but the safest step is to upgrade to a supported version such as PHP 8.3 or 8.4 after testing your site on a staging copy.

Can I use the partial mitigations instead of updating?

Only as a stopgap. PHP says the measures reduce exposure to some attack paths but "do not make an installation safe". The NCSC suggests applying them only if you cannot update, and taking the system offline if even that is not possible quickly. Plan the full update as soon as you can.

Is the vulnerability being exploited?

The UK NCSC's alert does not say exploitation has been observed and says it is monitoring for impact on UK organisations. New Zealand's NCSC said on 22 October 2026 that it is aware of reports of active exploitation. Given critical ratings and public fixes, assume attackers are looking and patch promptly.

Drupal Critical Security Release, October 2026: What Site Owners Must Do: Drupal fixed a critical Field UI remote code execution flaw on October 14, 2026, rated 19/25. Which versions are safe, the stopgap and a patch checklist.

PHP Critical Security Release, October 2026: What UK Websites Must Do