PHP team patches critical vulnerabilities threatening WordPress and online stores
Two bugs allow a server to be taken over without logging in. Updating WordPress or plugins will not help here: the patch must be installed by the hosting provider, and a maintenance outage requires a response code that preserves the site's position in Google.
On Wednesday, 21 October, the PHP security team released emergency patches for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). They allow code to be executed remotely on the server without logging in. Versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are safe. According to the PHP developers, there is no workaround that fully replaces the update. Apache servers with the mod_php module, which runs PHP directly inside the server, are the most at risk, because there the attack can start before the website's own code takes effect.
According to estimates by Wiz, about 70 percent of websites run on PHP. It is used by WordPress, Drupal, Joomla and Magento, among others. The PHP Foundation rates the severity of the vulnerabilities at 9.2 on a 10-point scale. Details leaked the day before the patch was released, and Cloudflare reported the first attacks almost six hours before it, according to My Company Polska. However, in an alert dated 21 October, the U.S. agency CISA wrote that it had not yet observed confirmed attacks. Finland and the Netherlands shut down some government services as a precaution.
The PHP version can be checked in the WordPress panel: Tools > Site Health > Info > Server. Installation of the fixed version must be requested from the hosting provider or software house. PHP 8.1 and older no longer receive regular official updates, and for versions 7.4-8.1 only limited source code fixes were published for teams that build PHP themselves. In that case, a backup and migration to a supported version are needed. A WAF firewall (a traffic filter protecting web applications) will stop some attacks, but it does not replace the patch, according to Search Engine Journal. After the update, it is worth checking whether there are malicious scripts, unknown administrator accounts and modified PHP files on the server, because the patch does not remove a previous breach.
If the site cannot be patched immediately, the EU computer security incident response team CERT-EU advises temporarily taking it offline. Google Search Central recommends serving a message with HTTP status code 503 during the outage, which means the service is temporarily unavailable. Then indexed URLs remain in the search engine. The code must come from outside PHP, for example from the web server or CDN (a network of servers delivering content). The robots.txt file with instructions for search engine crawlers should respond normally, because a 503 code returned for it blocks indexing of the entire site. According to Google's documentation, status code 503 should not be returned for longer than one to two days, because URLs may drop out of the index.