Critical PHP security release · October 21, 2026

Critical PHP flaws. Get your site patched.

Two critical vulnerabilities in PHP can allow an attacker to run code without logging in. If your business depends on a PHP website or application, get its running version checked and the security update applied.

Find out whether your live website is running affected PHP
Apply the appropriate update with backups and compatibility checks
Verify the live runtime, key pages, forms, and background jobs afterward

Free website check · No email required

Check your PHP version now.

Could your site be exposed to the critical PHP flaws? Check its reported version against the security fixes.

Public version check only; hidden versions and vendor backports need verification. We save the website and result and notify our team for business follow-up. Privacy Policy.

Need help verifying or updating PHP? Talk to us →

Get help checking and patching your site.

Send your website address and the best way to reach you. If you know your hosting provider or PHP version, include it. We will review the setup and confirm the next steps with you.

Enter an email address or phone number so we can get back to you. Other details are optional.

First name optional Last name optional

Email Phone

Company optional Website address and what you know so far optional

With your contact permission below, we save details as you fill in this form so we can follow up even if you do not submit it.

No sales script. Start with the problem and we’ll tell you whether we can help.

A runtime update needs attention

Your website can look fine and still need the patch.

On October 21, 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution. PHP recommends updating affected installations immediately.

The fixes are included in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some hosting providers and Linux vendors supply equivalent backported fixes. The important check is the PHP runtime actually serving your website, including the vendor's patch status.

Updating WordPress, a plugin, or another CMS alone does not necessarily update PHP. Your hosting provider or infrastructure team may need to change the server package or rebuild and redeploy the application container.

Read the official PHP security announcement. If you are unsure what your site runs, send us its address and hosting details to start the conversation.

Check it. Patch it. Verify it.

Confirm what is running

Identify the live PHP version, hosting setup, and vendor patch status. Establish what needs changing and who has the access to do it.

Apply the security update

Preserve the application and its data, check compatibility, and update the runtime through the appropriate hosting or deployment process.

Verify the result

Confirm the patched version is serving live requests, then check the pages, forms, and scheduled work your business relies on.

Relevant work

We applied this update to our own production site.

On October 21, we upgraded Stork's production website from PHP 8.4.26 to 8.4.27. We preserved the live application and content, checked the replacement before deployment, and verified the public site afterward.

PHP extensions and application platform requirements checked before deployment
Existing submissions, sessions, uploads, and user accounts carried forward
Live runtime, public pages, load balancer health, and inquiry digest checked after deployment

See our development support services →

Good fit

Get in touch if any of these sound familiar.

You received a PHP security alert and need someone to handle it
You run WordPress, Laravel, Statamic, or a custom PHP application
Your hosting provider has not confirmed whether the fix is installed
Your site relies on an older PHP version and you need an upgrade plan
You have several sites or containers and need to verify each one

Do not leave the patch status to guesswork.

Send us your website address and hosting details. We will help establish what needs updating and confirm the scope, access requirements, and timing before work begins.

Request urgent PHP help