What an attacker can do
Run their own code on your server: change the website, steal customer data or use the server for further attacks.
New vulnerability · published 21.10.2026
Critical PHP vulnerabilities. Check your website.
Two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, let an attacker take full control of a web server. Many websites run on PHP, including every WordPress site.
First we answer the PHP question from one ordinary visit to your homepage. Then, in about 20 seconds, a wider scan reads the public information about your website and domain and looks at which services are open. We don't send an attack or try to exploit anything.
For a technical person: check it yourself
Your hosting hides the PHP version from visitors. You can reveal it to this check in one of two ways.
Option 1: upload a one-time check file
- Download the check file (3 lines: it prints only the PHP version, then deletes itself).
- Upload it to your website's main folder, the same one that holds index.php. Your hosting file manager or your IT partner can do this.
- Click "Check again".
What the security check adds
- Software and plugin versionsWhether WordPress, its plugins or the server software have known security flaws.
- Admin areasWhether an admin panel, database manager or test site can be found from the internet.
- Leaked keys and passwordsWhether API keys or passwords sit in the page code or in public files.
- Backups and configuration filesWhether a backup or configuration file can be downloaded publicly.
- SubdomainsWhether a forgotten subdomain is open or can be taken over.
- A person reviews every findingEach finding is checked by a person, with instructions on how to fix it.
Not part of this free check.
What happened
What you need to know.
Both vulnerabilities are rated critical: 9.2 out of 10 according to the PHP project (CVSS 4.0).
Older PHP versions
All PHP versions older than those in the table below. PHP 8.1 and older are affected and no longer receive fixes.
Update PHP
Ask your IT partner or hosting provider to update PHP. According to the PHP developers, updating is the only complete fix.
Fixed versions
These versions contain the fix.
If your PHP is older than the version listed for its branch, it is affected.
| PHP branch | Fixed from |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No fix is coming. Upgrade to a supported branch. |
Questions
What the result means.
Why don't you test the vulnerability directly?
A direct test would mean sending an attack to your server. We only do that with the owner's written permission, as part of a security check. This check reads only what your website shows every visitor.
The result says the version isn't visible. What now?
Many servers hide their PHP version, which is good practice. In that case, ask your IT partner or hosting provider whether PHP has been updated. We can also run a deeper check.
The version has a tag like "ubuntu" or "deb". Am I at risk?
Linux distributions sometimes add fixes without changing the version number. Ask your hosting provider whether the security update is installed.
I use WordPress. Is updating WordPress enough?
No. The vulnerability is in PHP, not in WordPress. The server's PHP version has to be updated, which is usually done by your hosting provider.
Sources: PHP project security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp; NVD entries CVE-2026-109618 and CVE-2026-109619. We do not represent the PHP project or any government authority.