---
title: "PHP vulnerability CVE-2026-109618: is your website affected?"
description: "PHP is patching two critical vulnerabilities rated CVSS 9.2 today. Any PHP website can be exposed, WordPress and e-shops included. What to do today."
canonical: "https://interfase.sk/en/news/php-vulnerability-cve-2026-109618-is-your-website-affected"
lang: "en"
last_updated: "2026-10-21"
---

# PHP vulnerability CVE-2026-109618: is your website affected?

> PHP is patching two critical vulnerabilities rated CVSS 9.2 today. Any PHP website can be exposed, WordPress and e-shops included. What to do today.

Published: 2026-10-21

- On 21 October 2026 at 14:00 UTC, PHP fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2.
- The flaw is in PHP itself, so an up-to-date WordPress, Joomla, Drupal, e-shop or custom application is exposed too.
- Details leaked before the fix and a video of an attack is already public, so there is no reason to wait with the update.
- The full process and the fixed versions, added as they are released, are in the Cybair article.

On 20 October 2026 the PHP team announced two critical vulnerabilities in the PHP language itself – CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 out of 10 and could let an attacker run their own code on a server without logging in. Fixed PHP versions are released on 21 October 2026 at 14:00 UTC.

We have written up the full process, the timeline and the fixed versions, which we keep adding as they are released, on the website of our security division Cybair: [Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: what to do now](https://cybair.sk/en/news/critical-php-vulnerability-cve-2026-109618).

## Does this affect your website?

If it runs on PHP, almost certainly. The flaw is not in the CMS or its plugins but in PHP, which runs them. A fully up-to-date WordPress, WooCommerce, Joomla, Drupal, PrestaShop or Magento shop, or a custom application in Laravel, Symfony or Nette can therefore still be exposed. What matters is the PHP version on the server, not the version of the website.

The less visible tools are the easiest to forget. phpMyAdmin, Nextcloud, Moodle or old test installations are just as reachable from the internet as the main website.

## Why not to put it off

Details of the flaws leaked before a fix existed, and a security researcher has already posted a video of an attack that wipes the content of several common PHP applications in turn. Once the fix is out, the risk rises further: changes to PHP’s source code are public, and sites left on an old version become targets for automated scans.

## What to do today

1. List every PHP website, e-shop and application, including test installations.
2. Check which PHP version each one runs on.
3. Agree an update window with your hosting provider or server administrator, and make sure you have a working backup.
4. Deploy the fixed version once it is out. PHP 8.1 and older will not get a fix – they need to move to a supported branch.

Where to find the PHP version in WordPress, Joomla or Drupal, what to do if you cannot update straight away, and whether a web application firewall will protect you is covered in the [Cybair guide to PHP vulnerability CVE-2026-109618](https://cybair.sk/en/news/critical-php-vulnerability-cve-2026-109618).

## Need help?

The Cybair security team checks the PHP versions on all your websites and applications, deploys the fix directly in your environment and confirms with a retest that the vulnerability is gone. Get in touch through the [form in the Cybair article](https://cybair.sk/en/news/critical-php-vulnerability-cve-2026-109618#form).


---

Web version: https://interfase.sk/en/news/php-vulnerability-cve-2026-109618-is-your-website-affected
llms.txt: https://interfase.sk/llms.txt