Is your website affected by the PHP security fix? How to check

If you have seen the PHP security headlines and wondered whether you need to do something, start by checking what your website runs on and who manages its hosting. You do not need to guess or change settings you do not understand.

Reporting checked October 21, 2026. This is information to help you ask the right questions, not a security audit or a finding about your website.

What happened, in plain words?

PHP is software that runs on a server and helps many websites work. On October 21, 2026, the PHP project released fixes for two critical flaws: CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 using CVSS v4.0, according to the first advisory and second advisory.

The concern is that, under the right conditions, someone could run code on an affected server without logging in. That describes what the flaws can allow. It does not tell us whether your individual site has been attacked.

Reports about attacks differ. Reuters reported that Cloudflare said early attacks were emerging and it was adding temporary firewall rules. In its October 21 alert, Australia’s ACSC said it was not aware of active exploitation. Those were different observations at the time of reporting. A temporary firewall rule should not be treated as confirmation that PHP itself has been updated.

CERT-EU advised considering taking affected applications off public networks when patching is not feasible. NL Times reported the Dutch NCSC’s warning that some sites taken offline could need hours to return. That is context, not a reason to switch off your site without checking with the person responsible.

Does this apply to your website?

A site that does not run PHP is not affected by these PHP-specific flaws. Purely static websites do not run PHP to serve their pages. Bloomwired.io itself does not run PHP, so this particular fix does not apply to our own site.

WordPress uses PHP. If you use WordPress, ask who handles the server update. Your managed host may already be doing that work, but get confirmation. Wordfence explains why WordPress automatic updates do not apply these fixes.

For a standard hosted site on Wix, Squarespace or Shopify, you do not manage a PHP installation yourself. Wix does not let you add PHP code, Squarespace does not support server-side PHP code, and Shopify manages its hosted storefront infrastructure and platform updates. Follow your provider’s guidance.

Check separate services too. For example, a hosted storefront and a separate WordPress blog may have different providers. A builder’s name alone does not confirm what every connected app runs on.

How can you check without being technical?

1. Find your platform. Look at where you normally sign in to edit the site. If somebody built it for you, ask what platform it uses.
2. Find your host. Check your hosting invoice, account list or project handover. The company that registered your domain may be different from the company running your website.
3. Look for the PHP version. In the hosting dashboard, look for PHP settings or a PHP version section. In WordPress, Wordfence points to Tools → Site Health → Info → Server.
4. Ask for confirmation. If the settings are unclear, use the message below. Ask whether both fixes are applied to the PHP installation actually serving your site.

The fixed releases announced October 21 are:

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35

Compare the version within its branch. “PHP 8” alone is not enough information. If the host uses a different package label, ask it to confirm the two CVE fixes directly rather than trying to interpret the label yourself.

What should you send your host?

Copy this into a support request using the contact details in your existing hosting account. Replace “my website” with your domain if you manage more than one.

Hi. Could you confirm whether my website uses PHP and whether the fixes for CVE-2026-109618 and CVE-2026-109619 are applied? Is my site on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a newer fixed release in its branch? Please confirm who handles this update and whether a backup and compatibility check are needed before any change. Thank you.

Keep the answer with your website records. You want to know what was checked, who applied the update and whether anything is still outstanding.

What I’d be careful about

• Do not panic. Start with the platform and hosting checks. A headline does not establish what is happening on your site.
• Do not rely on plugin updates for this fix. Confirm the PHP update separately.
• Be wary of unexpected “your site is hacked” emails. Contact your host through the account or address you already trust. Do not give a stranger access because they sent an alarming message.
• Take a backup before changing PHP. Ask the host to handle the update and check compatibility if you are unsure. Agree how to recover if something stops working.