I’m Jason Spangler, a staff software engineer and freelance web developer in Greater Chattanooga. I help business owners understand what needs attention, coordinate with their hosting company, and get website updates working.
Why check your site now?
On October 21, 2026, PHP released fixes for two critical security flaws that could let attackers run code on a server. If your site uses PHP, ask your host to confirm the fixes are installed. A site that looks normal can still need an update. Read PHP’s advisory.
WordPress uses PHP, but this issue also affects other PHP applications. Updating WordPress or a plugin alone does not apply the server’s PHP fix; your host may already have handled it. WordPress explains what to check.
Guidance checked .
Start with your hosting company
Ask: “Has the PHP running my website been patched for the October 21 security vulnerabilities, and have you reviewed PHP’s October 23 follow-up?” Save their reply so we can work from confirmed information.
In WordPress, find your PHP version under Tools → Site Health → Info → Server. Your hosting dashboard may show it too. If you’re unsure what you’re looking at, send me the notice and your website address.
Technical details for you or your host
The October 21 fixes address CVE-2026-109618 and CVE-2026-109619. These were the fixed releases for each supported branch:
- PHP 8.2
- 8.2.35
- PHP 8.3
- 8.3.36
- PHP 8.4
- 8.4.27
- PHP 8.5
- 8.5.12
Use the latest patched release your host supports, or have the host confirm a vendor-backported fix. A displayed version number alone may not show a backport. PHP 8.1 and older are outside regular PHP project support; ask about vendor fixes and an upgrade plan.
PHP’s October 23 follow-up also recommends reviewing session upload progress settings for an additional, configuration-dependent risk. Ask your host to review it even after applying the October 21 patches.
How I can help
- Understand the notice. Review the site, hosting details, and confirmed patch status to identify the next steps.
- Plan and apply updates. Check backups, test compatibility on a separate copy where available, and coordinate PHP changes with your host.
- Fix update problems. Troubleshoot errors in themes, plugins, or custom code, then check key pages, forms, and customer flows.
- Make maintenance clearer. Explain what changed and what needs ongoing attention.
We’ll agree on scope, cost, and timing before work begins. If the site needs specialist incident response, I’ll explain that before we proceed.