PHP Security Flaw 2026: What Store and App Owners Must Do

On 21 October 2026 the PHP project released emergency fixes for two critical flaws that can let an attacker run code on a server without logging in. Security reporters say attacks started within hours, and some sites were taken offline while their operators patched.

This matters to anyone selling online, because a large share of online stores and app back ends run on PHP, including WordPress and WooCommerce.

What happened

• The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are rated 9.2 on the CVSS v4.0 scale.
• They sit in PHP itself, not in WordPress, so there is no WordPress update to install. The fix is a newer PHP version on the server.
• Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Exploits are reported to be circulating and used against live sites.

What to do today

1. Find out your PHP version. Ask your host or check Site Health in the WordPress admin.
2. Update PHP to a fixed release, or ask your host to confirm in writing that your version has the fix backported.
3. Take a fresh backup before and after, and store it off the server.
4. Check for signs of a break-in: unknown PHP files, new admin users, modified core files, strange redirects, spam emails sent from your domain.
5. Rotate secrets if anything looks wrong: admin passwords, database password, API keys and payment gateway keys.
6. Stop-gap only: if you cannot update immediately, set session.upload_progress.enabled = 0 and restart PHP. This blocks one attack path, not both.

What the official PHP announcement adds

The PHP project’s own announcement (see sources) describes the two flaws as follows:

• CVE-2026-109618 is a remote code execution flaw caused by out-of-memory handling that can interrupt PHP while internal request data is only partly set up.
• CVE-2026-109619 is a remote code execution flaw in which request-related internal state can survive after its memory is freed and be reused by a later request on the same worker.

The announcement says the risk is highest with mod_php, where an unauthenticated request can trigger the problem before any application code runs. Other setups it names as affected include PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. It also lists server-level limits that reduce exposure for the first flaw, for example a low post_max_size and request-size limits at the web server. Those are for hosts and administrators, so pass the list to whoever manages your server instead of changing settings yourself.

A related advisory dated 23 October 2026 covers a lower-risk issue, CVE-2026-115560, which needs an unusual combination of session settings and code. It will be fixed in the next regular release, and the recommended interim step is the same session.upload_progress.enabled setting, which you should keep in place if you already applied it.

If you have a mobile app

The app on the phone is not the weak point. Its server is. If your app talks to a PHP API, confirm that the API server has been patched, because a break-in there exposes customer and order data for every user of the app.

The lesson for store owners

Software your store depends on will have urgent fixes. Whoever hosts and maintains your platform should be able to answer three questions within minutes: what runs on the server, which version, and who patches it. If nobody can answer, that is the risk to fix first.

The week the internet held its breath

Imagine you run a small online shop. On a Wednesday you open your phone and see messages from friends: “Is your website down?” “Did you see the PHP news?” You have never thought about PHP in your life. It is just something your developer or hosting company set up. Yet suddenly security sites, news outlets and even WordPress.org are telling people to update it immediately.

That was the situation for many store owners on 21 October 2026. This guide explains what happened in simple terms, why it mattered for sellers, and exactly what to do, whether you are technical or not. No panic, no jargon, just a clear path.

What PHP is, in one minute

A website is not a single file. When a customer opens your product page, a program on the server assembles it: it reads the product from the database, adds the price, builds the page and sends it to the phone. For a large share of websites, including WordPress and WooCommerce, that program is written in PHP. Think of PHP as the engine under the bonnet. You never see it, but if the engine has a fault, the whole car is at risk.

What happened

The PHP project released emergency security updates for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Security reporters described them as allowing an attacker to run code on a vulnerable server without logging in, and rated them 9.2 on the CVSS v4.0 scale. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Reports said attacks started very quickly, and several outlets described websites going offline while operators patched. WordPress.org told site owners that no WordPress update was needed, because the flaws affect any server running PHP, and urged everyone to update PHP immediately and to check with their host.

Details such as exact numbers of affected sites were still being reported when this guide was written, so rely on your host and the official PHP announcement for the latest facts.

Why this matters even if you do not write code

Three reasons.

1. Your customers’ data lives on the server. Orders, names, addresses and emails are what attackers want.
2. Your reputation is on the line. A hacked store can redirect customers to scams, send spam in your name or show warnings in browsers.
3. Your sales stop when your site goes down. Whether the cause is an attack or a rushed fix, downtime costs money.

A calm, step-by-step plan

Step 1: Find out whether you use PHP

If your store runs on WordPress, WooCommerce, Magento, PrestaShop, OpenCart, Drupal or a custom PHP site, you do. If you use a hosted store builder, the vendor is responsible. If you are not sure, ask the person who built the site.

Step 2: Find your PHP version

In the WordPress admin, go to Tools, then Site Health, then Info, then Server. Your hosting panel may also show it. Write it down.

Step 3: Compare with the fixed versions

If you run 8.5, you want 8.5.12 or newer. For 8.4, 8.4.27 or newer. For 8.3, 8.3.36 or newer. For 8.2, 8.2.35 or newer. Versions older than 8.2 no longer receive security updates from the PHP project. The PHP project published minimal source backports for 7.4, 8.0 and 8.1, but these are not official releases, so ask your host or distribution whether they apply a fix and get the answer in writing.

Step 4: Ask your host to update, or update yourself

Managed hosts often do it for you. On other plans you choose the PHP version in the control panel. Take a backup first, update your plugins and theme, switch the version and test the store.

Step 5: Use the stop-gap only if you must

The PHP announcement lists temporary measures for people who cannot update at once, and stresses that they reduce exposure but do not make an installation safe. Updating is the only complete fix. The best known stop-gap is setting session.upload_progress.enabled to 0 in php.ini or your server configuration (not through ini_set) and restarting every PHP worker. It blocks the confirmed session paths of CVE-2026-109619 only, not CVE-2026-109618.

Step 6: Check for signs of a break-in

Look for unknown administrator users, unfamiliar files, redirects and spam sent from your domain. Our guide to checking whether your store was hacked lists the signs and the recovery steps.

Step 7: Rotate secrets if there is doubt

If anything looks suspicious, change admin passwords, database credentials, security keys and payment or API keys.

Step 8: Write it down

Note what you found, what you did and when. Next time it will take minutes.

If you have a mobile app

The app on a customer’s phone is not what attackers are after. They target the server it talks to. If your app’s API or admin runs on PHP, it needs the same fix. Ask your developer where the back end runs and request confirmation of the version and patch status. If the app and website share one back end, one patch protects both.

Common myths

“We are too small to be a target.” Attacks like this are automated. Scanners do not care about your size; they look for the weakness.

“My WordPress is up to date, so I am safe.” WordPress updates do not change the PHP underneath. The PHP version is a separate setting.

“My host takes care of everything.” Some do, some do not. Ask and get it in writing.

“A firewall is enough.” It can help while you patch, but it is not a replacement.

“Nothing happened to us, so we can relax.” Compromises can stay hidden for days or weeks, so a check is still wise.

What good looks like going forward

• A named person or partner responsible for server and software updates
• Automatic off-server backups with a tested restore
• A staging copy where updates are tested first
• Monitoring that alerts someone when files or users change
• A short written plan for what to do when an alert appears
• An inventory of every site, subdomain and app back end the business runs

How NNT Software can help

N & T Software Private Limited builds and supports online stores and Android and iOS apps, and security upkeep is part of how we work.

• Quick Review. Send us your website address and we will tell you what it runs on, the PHP version and what to fix first.
• Patching and testing. We can update PHP, plugins and platform, test checkout and payments and confirm in writing.
• Break-in checks and clean-up. We review users, files and logs and restore a clean state if needed.
• A safer platform. If your store is old or fragile, we can migrate it to a maintained NNT Mart platform with an app on the same back end.
• Ongoing care. Backups, monitoring and a written response time, so alerts become routine tasks.

Use the contact form or WhatsApp on this page and we will reply within minutes.

How NNT Software can help

If you want help with this alert, NNT Software can identify what your site runs on, read the PHP version, apply or arrange the update, test checkout and payments afterwards and check users and files for signs of a break-in. If the store is too old to patch safely, we can move it to a maintained NNT Mart platform with redirects so your search rankings are kept.

Sources

• Krebs on Security: widespread PHP flaw may cause many site outages
• Patchstack: PHP vulnerable to critical RCE, attacks ongoing
• Search Engine Journal: critical PHP core security flaws
• Codeable: PHP security release on 21 October 2026
• WordPress.org: critical PHP security release
• PHP.net: 2026 release announcements
• PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)