PHP CVE-2026-109618 and CVE-2026-109619: What They Mean for Your Website

The PHP security team has announced fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, due on Wednesday 21 October 2026 at 14:00 UTC. In New Zealand that is 3am on Thursday. Both are rated 9.2 out of 10 for severity. The team has not said what the flaws are yet. The details come out with the fixes.

PHP is the language WordPress, WooCommerce and most small business websites run on. If your site is built on WordPress, this release affects you.

Why CVE-2026-109618 and CVE-2026-109619 matter

Once a fix is published, attackers can compare the old and new code to work out what was wrong. Flaws rated this high are often attacked within hours of the details going public. The attacks are automated, so they try every site they can find, whatever its size.

The risky stretch is the gap between the fix being released and your host installing it. On some hosting that gap is a few hours. On some it is weeks.

Older PHP versions will not be fixed

Each PHP version gets security fixes for a set period, then they stop. PHP 8.1 and everything older no longer receive them, so this week's fixes will never reach a site running one of those versions. Plenty of New Zealand websites are still on PHP 7.4 or 8.0, usually because nobody has looked since the site was built.

If we host your website

You do not need to do anything. Every website we host is on a supported version of PHP, and we put extra protection in place ahead of the release.

Hosted with us and want to know more about your site? Get in touch and we will talk you through it.

If someone else hosts your website

These are worth checking today.

• Find out which PHP version your site runs. In WordPress, go to Tools, then Site Health, then Info, and open the Server section.
• If it is PHP 8.1 or older, ask your host or developer to move it to PHP 8.3 or 8.4. Test the site afterwards, because older plugins and themes sometimes break on newer versions.
• Ask your host when they will install the 21 October fixes. A good host will already have an answer.
• Make sure you have a recent backup stored somewhere other than your hosting account.
• Update WordPress, your plugins and your theme, so an old plugin is not the easier way in.

If you are not sure who hosts your site, or the answers you get back are vague, we can look at it for you. Our free website audit checks for out-of-date software, and our hosting and maintenance plans include security updates.

If you think your site has already been hacked, our WordPress hack cleanup service can get it clean and keep it that way.