PHP vulnerability of 21 October: what does it mean for your website?

What happened?

On 21 October 2026, PHP released an urgent update for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). PHP is the software on the server that runs WordPress, WooCommerce and many other websites. Through these vulnerabilities, someone from outside can make a server run code without logging in.

In Belgium and the Netherlands, many organisations took their site offline as a precaution that day, including websites of the Flemish government and Smartschool, and in the Netherlands a number of Dutch central government websites. The Centre for Cybersecurity Belgium (CCB) recommends installing the update as soon as possible. CERT-EU recommends considering shielding your site until the update is installed; for PHP older than 8.2 on your own hosting, WordPress.org recommends considering taking your server offline temporarily.

Sources (in Dutch and English): php.net, VRT NWS, Rijksoverheid, VRT NWS liveblog (CCB), NCSC, CERT-EU, WordPress.org.

Am I affected?

Does your site run on WordPress or another PHP application? Then you need to check this. Important to know: the vulnerability is not in WordPress or in a plugin, but in PHP itself. Updating WordPress or your plugins therefore does not fix it.

How to check:

1. In WordPress, go to Tools > Site Health > Info > Server and look at the PHP version.
2. Patched versions are: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or higher within the same branch.
3. Does it say 8.1 or older? PHP itself no longer releases regular updates for those.

Not sure? Ask your web developer or hosting provider.

What should you do now?

• Shared or managed hosting: your host usually updates PHP itself. Check with them whether the update has been installed.
• Own server or VPS: have whoever manages your server update PHP today.
• PHP 8.1 or older: make a backup and have your site moved to a supported version. CERT-EU recommends considering shielding your site until the update is installed; for PHP older than 8.2 on your own hosting, WordPress.org recommends considering taking your server offline temporarily.
• Watch out for fake emails: do you receive an email "from your host" asking you to log in or share your password? Don't click, and go to your customer area via your own bookmark.

The free PHPGuard check

Our free scan shows whether your visible PHP version is patched. If it is hidden, ask your host.

• Does your server show its PHP version (for example in a header)? Then the scan tells you whether that version is at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
• Does your server hide its PHP version? Many servers do, and that is a good habit in itself. Then the scan cannot say anything about it. Ask your host or web developer.
• The result is an indication, not a final verdict. Linux distributions such as Debian, Ubuntu and Red Hat, and some hosting providers, apply security fixes without changing the version number. A version that looks old may therefore still be patched. Not sure? Check with your host.

What the scan can show

• Possibly unpatched
  Possibly unpatched: check with your host

  Check with your host whether the PHP security update of 21 October has been installed.

• Outdated PHP branch
  PHP branch without regular updates

  Ask your host or web developer to move your site to a supported PHP version.

• Version could not be determined
  PHP version could not be determined

  Ask your host whether you are on a patched PHP version.

In addition, the scan performs a general, passive check: outdated WordPress and plugins, exposed sensitive files (such as backups or a phpinfo page), PHP and server settings, https and security headers. No plugin, no access to your hosting, no attacks. You get a risk score from 0 to 100 and see which categories have problems.

Only scan your own site, or a site you have permission for.

👉 Run the free check