Blog

Two critical PHP flaws: what small business sites should do now

October 27, 2026

On October 21, 2026, the PHP project shipped emergency security releases for two critical flaws in the PHP interpreter itself. If your website runs on PHP, which includes most WordPress sites, your server needs to be updated now.

What happened?

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 in severity. One is a memory corruption bug in how PHP handles running out of memory. The other is a use-after-free bug involving data kept between requests. Both let an attacker run code on a server remotely, without logging in.

The fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its list of vulnerabilities known to be exploited in the wild, and researchers have reported active attacks.

Is my website affected?

Your site may be affected if it runs on a server with PHP, which is true of most WordPress, Drupal and Joomla sites and many custom sites. Whether you are exposed depends on which PHP version your host runs and whether they have already updated it.

What should I do right now?

• Ask your host or web developer which PHP version your site runs, and confirm it has been updated to one of the patched releases.
• If you manage your own server, update PHP and restart it. PHP has noted a regression in 8.4.27 and 8.5.12 and published a follow-up advisory on October 23, so check the PHP site for the latest guidance.
• Keep your themes, plugins and content management system up to date as well.
• Make sure you have a recent backup of your site.

Many managed hosts patch PHP for their customers automatically. If you are on one, the most useful step is simply confirming with them that it is done.

Why does this keep happening?

Every website depends on software that needs regular security updates. When you run your own server or hosting plan, keeping that software current is part of the job, and it tends to land on whoever is least available when an emergency patch drops on a Tuesday afternoon.

That is one of the reasons we built Lentil. Lentil sites are hosted and maintained by us, so there is no server, PHP version or plugin list for you to keep up to date. Keeping the platform patched is our job, not yours.