PHP security, explained
What to verify
with your host.
Guidance reviewed October 25, 2026. Read the official sources for any changes after this date.
What happened in October?
On October 21, PHP published updates for two critical code-execution flaws, CVE-2026-109618 and CVE-2026-109619, involving memory and error handling. In vulnerable installations, successful exploitation could let an attacker run code with the application’s access: potentially exposing data, changing pages, or interrupting service. This does not mean every PHP website can be exploited or is under attack.
On October 23, PHP published additional session-upload configuration guidance related to CVE-2026-115560. A listed version fix does not settle configuration-dependent risks. Ask your host to review the current official advice.
Four useful checks to make
- Identify the version serving your website. Use the hosting panel or, in WordPress, Tools → Site Health → Info → Server. Command-line PHP may use a different version.
- Confirm the actual installed patches. Your host can check packages and vendor updates. A distribution may backport security fixes while retaining an older upstream version label.
- Review configuration and compatibility. Have a maintainer check current PHP guidance and test the application before upgrading. Do not publish phpinfo(), upload a diagnostic script, or share passwords for a public check.
- Make a support plan. If upstream support has ended, ask about vendor coverage and plan a move to a supported PHP branch.
A public website check can identify some advertised signals. It cannot inspect installed packages, certify security, or confirm that an attacker can exploit the site.
Official sources: PHP security announcements and PHP support dates.
Use the free PHP checker →