Critical PHP flaws: is your website patched?
On 21 October PHP released fixes for two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that let attackers run their own code on a web server without logging in. ENISA, Europol and the European Commission urged organisations to patch immediately.
Are you affected?
Most business websites run on PHP. Three quick checks tell you whether this concerns you.
WordPress, WooCommerce, Laravel, Magento, Drupal, Joomla, TYPO3 and most shared hosting plans run on PHP.
Each supported PHP line has a fixed release. Older lines (8.1 and below) no longer get updates from the PHP project: ask your vendor for a backported fix or upgrade.
8.5.128.4.278.3.368.2.35Hosts sometimes patch without changing the version number, and the PHP that serves your website can differ from the one on the command line. Ask for a clear confirmation.
Ask your host one question
The fastest way to know: send this to your hosting provider or the person who runs your server.
Tip: replace [your-domain] with your website address.
Hello, following the PHP security release of 21 October 2026 (CVE-2026-109618 and CVE-2026-109619): which PHP version serves our website [your-domain], and is the fix applied? If not yet, when will it be? Thank you.Copied
How we can help
Start with a free check. Pay only if an update is needed, at a fixed price agreed upfront.
Free check
Just your website address. Within one business day we tell you which platform and PHP version your site shows, who hosts it, and the one question that settles the patch status. Forward us your host’s answer and we confirm it.
Safe PHP update
Backup and restore check, the update, tests of your key pages and forms, a rollback plan and a short report.
Extra PHP developers
Patching many client sites this week? We add experienced PHP developers to your team within days.
How it works
Send the address
Reply to our email or use the form below. That’s all we need.
We check from the outside
Platform, visible PHP version and hosting provider. Clear answer within one business day.
One question to your host
If the version is hidden, you get the exact question to ask. Forward the answer and we confirm it.
Fixed-price update if needed
Backup, update, tests and a short report, at a price agreed before we start.
Request a free check
Tell us which site to look at. A person from our team replies, usually within one business day.
You can also simply reply “check” to our email.
Official sources
Questions
Does this mean my website has been hacked?
No. It means a fix exists and should be applied quickly. We never claim a site is compromised without evidence; if you see warning signs, we treat it as a separate incident check.
My host manages everything. Do I need to do anything?
Ask them for a written confirmation that the PHP serving your site is patched. Most hosts are updating now; a short confirmation removes the doubt.
Our site runs on Shopify, Wix or Webflow.
Then your main site isn’t affected directly. Check whether you run anything else on PHP, such as a blog, shop, booking tool or staging site.
Can a PHP update break my site?
It can if themes, plugins or custom code are old. That’s why we check backups, test key pages and keep a rollback plan before changing production.
