Critical PHP update: how to check your business website

You update WordPress before the first appointment. Your host may still have a separate security update to do.

On October 21, 2026, the PHP team released fixes for two critical vulnerabilities. If your website uses PHP, ask your host today to confirm both fixes in the software serving your domain. PHP is the software that runs PHP applications on the server, including WordPress. You may see your host call it the runtime.

WordPress's own October 21 notice makes the distinction clear: these are PHP flaws. Updating WordPress, its plugins, a theme, or an application framework does not install the PHP runtime fixes. Your host or server administrator has that job.

I would get a written answer before treating this as finished. A working homepage does not tell you whether the host applied a security patch.

Does my business website use PHP?

Start with the system you use to edit the site. If you use WordPress, you use PHP. For another website platform or a custom site, ask your host or developer whether any part of your website uses PHP to serve visitors.

You can collect the version without changing anything:

1. WordPress: open Tools > Site Health > Info > Server. Find the PHP version and copy it. The Site Health documentation explains the server information panel.
2. cPanel: open Software > MultiPHP Manager and find your actual domain in the list. Check its PHP setting, including whether it inherits a setting from the server. cPanel's documentation confirms that different domains can use different PHP configurations.

If you cannot find either screen, send the host your domain and ask. A label such as 8.3 names a release branch. It leaves out the patch number. A developer's command-line PHP version may also differ from the version handling your website visitors.

For example, a dog groomer in Brownsburg could have a WordPress site and a booking service on a separate domain. Ask about both. Confirmation for the homepage's hosting account does not establish what the booking provider runs.

Do not upload a public phpinfo page or run an exploit test to find out. You can get the information through your hosting account or a support ticket.

Which PHP versions contain the fixes?

Both official advisories list these fixed releases as of October 22, 2026. Read across the row for your branch:

Your PHP branch	First upstream release with both fixes
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

An upstream release is the version the PHP project publishes. Hosts may use a vendor's package instead. Vendors sometimes add security fixes to an older package without changing its visible PHP version to one of those numbers. That is a backport. Ask for the package details and confirmation of both fixes before judging it by the version alone.

The two reference numbers are CVE-2026-109618, concerning memory handling when PHP runs out of memory, and CVE-2026-109619, concerning leftover internal state between requests. The advisories describe how an attacker could run code on an affected server. The CVE numbers let your host identify the exact problems.

In its October 21 announcement, the PHP team includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed among installations serving web requests that need attention. The team puts the highest risk on mod_php, with a demonstrated attack before application code runs.

The first advisory and second advisory describe different conditions across setups. They do not establish an identical demonstrated exploit for every configuration. Finding an affected version also does not establish that anyone compromised your business.

PHP 8.1 and older are outside the PHP project's regular security support. The team supplied exceptional source backports for 7.4, 8.0, and 8.1. Ask your vendor to confirm both fixes in its package or arrange a supported upgrade.

What should I ask my website host?

Copy this into a support ticket and replace [domain] with your website address:

"Please confirm whether the PHP runtime serving [domain] has fixes for CVE-2026-109618 and CVE-2026-109619. What exact version or vendor package is active, and have required restarts completed? If not patched, what is the remediation plan?"

Ask for a completion time if the host still needs to act. If you pay a separate developer for maintenance, include them in the same conversation. Name one person responsible for confirming the result.

Ask your host for confirmation against both vulnerability numbers before you mark this job complete.

Have the host or developer patch promptly, with a current backup and compatibility checks. WordPress's PHP update guide recommends backups and checking theme and plugin compatibility. Its general branch recommendation is not proof that these October security fixes are present.

Do not choose PHP 8.6 release candidates for a production site. Do not treat a firewall rule or a setting change copied from a forum as a complete fix. If the host cannot patch promptly, ask its security team what temporary protection or service restriction it recommends while it resolves the problem.

Test the parts customers use

After the host confirms the update and required restarts, check the customer tasks that bring in business. A mechanic in Franklin should submit a test repair request and find the message in the shop's inbox. The Brownsburg groomer should make a test booking, check the confirmation, and remove the test appointment afterward.

For a site with checkout, arrange a test order with your developer and confirm the receipt and order record. Test the forms and login areas your staff depend on too. Record the result and time beside the host's confirmation.

We covered the delivery check in our contact-form walkthrough. A thank-you screen alone does not prove that you received the customer's request. Kevin's fifteen-minute website check adds a broader phone check after maintenance.

If your host's answer still leaves you unsure who owns the next step, send Luminest the reply. We can help you work out what to ask next.

Keep the ticket open until you have the host's confirmation and your own test result beside it.

---

Sources

#	Source	What it backed up
1	PHP: October 21, 2026 security announcement	Scope across web-serving PHP installations, highest stated risk for mod_php, and vendor support for older branches.
2	PHP advisory: CVE-2026-109618	Memory-handling vulnerability, fixed releases by branch, and configuration-dependent exposure.
3	PHP advisory: CVE-2026-109619	Stale internal state vulnerability, fixed releases, and limits of configuration changes.
4	WordPress: Critical PHP security release	Urgency, the distinction between PHP and WordPress updates, and the PHP version check.
5	WordPress: Site Health screen	Location and purpose of the server information panel.
6	cPanel: MultiPHP Manager	Domain-specific PHP settings and inherited configurations.
7	WordPress: Updating PHP	Backups and application compatibility checks before changing PHP.