If your business website runs on PHP or WordPress, there’s one simple question worth asking your web host or IT provider today: “Have you applied the latest PHP security update?”
Here’s what happened and what to ask, in plain words.
What happened
On October 21, 2026, the PHP project released security updates for two critical flaws, nicknamed “PHP2Shell”:
- CVE-2026-109618, a flaw in how PHP handles running out of memory
- CVE-2026-109619, a flaw where leftover data from one web request can be reused by a later one
According to the PHP security advisory, both can allow an attacker to run code on a web server without logging in. PHP says all installations serving web requests are at risk, including common setups like PHP-FPM, Apache with mod_php and LiteSpeed. PHP rates both critical, 9.2 out of 10 (see the NVD records for CVE-2026-109618 and CVE-2026-109619).
The same day, CISA, the U.S. cybersecurity agency, urged organizations to patch right away, starting with internet-facing systems.
Why it matters for your business
PHP runs many business websites, and WordPress is built on it. You usually can’t tell which PHP version your site uses just by looking at it. CISA also notes that PHP is often built into other software, so it may be running in places you would not expect.
AI is speeding this up
OpenAI says AI helped find these flaws, and it expects similar findings “to increase sharply in the coming months” (OpenAI). The takeaway: updates need to go on fast, and someone needs to keep watching your servers.
The good news: the fix is a standard update. Most of the work sits with whoever hosts or manages your site. Your part is making sure they’ve done it.
The fixed versions
PHP’s fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Linux distributions and long-term support vendors also ship their own patched packages, so a host may show a different version number that still includes the fix. PHP 8.1 and older no longer get updates from the PHP project.
What to ask your web host or IT provider
Copy this list into an email:
- Which PHP version are our websites running?
- Has it been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor package that includes the PHP2Shell fixes?
- Do any other systems we use run PHP, such as portals, forms or booking tools? Are those updated too?
- If we’re on PHP 8.1 or older, what’s the plan to upgrade?
- Are you watching for unusual activity on our server? CISA recommends monitoring for suspicious activity.
If the answers are clear and confirmed, you’re in good shape. If you’re unsure who manages your site, that’s worth sorting out now.
How World Technology helps
World Technology started in Lawrenceville and Gwinnett County in 2005 and now supports small and mid-size businesses across the US, in Europe and globally, helping them keep their systems updated and secure. If you’d like help checking your website or asking the right questions, we’re glad to help.
Free website check: we’ll confirm which PHP version your site runs and whether it has the fixes.
Call us at 678-985-8222 or email contact@wtcomputers.com.
Sources: PHP security advisory, CISA alert, OpenAI, NVD CVE-2026-109618 and CVE-2026-109619.
— WT Team