An illustration of critical PHP vulnerabilities, featuring an elephant symbol, a website, servers, malicious software, and a broken security shield.
Security Threat to PHP Websites

If you run a website on WordPress, Joomla, Drupal, or another PHP-based platform, it’s worth paying attention to a new warning from cybersecurity experts. Two critical security holes have been found in the popular programming language. They could potentially let attackers get into servers, steal data, or wreak havoc on websites.

One of the first to raise the alarm was CERT-EU, the European computer emergency response team. And the situation is serious: websites that can’t be secured quickly may need to be taken offline altogether, at least temporarily. The PHP team is already working on patches, but sitting around waiting for things to sort themselves out isn’t the best idea.

What We Know About the New Vulnerabilities

The two newly discovered flaws have been registered as CVE-2026-109618 and CVE-2026-109619. Both received a score of 9.2 out of 10 under CVSS 4.0. That number pretty much speaks for itself.

According to CERT-EU, these vulnerabilities allow attackers to execute malicious code remotely without any authentication. In other words, a hacker doesn’t need an admin username or password to try running their own commands on a server.

The developers haven’t released the technical details yet, and there’s still no complete list of affected builds. Early indications suggest that almost every version, going all the way back to PHP 5, could be at risk. Of course, that doesn’t mean every other website has already been hacked. The actual danger depends heavily on the server configuration. But the potential scale is big enough that everyone needs to check.

Which Websites Should Be Most Concerned

PHP runs on the server and handles most of the basic functionality, from processing forms and logging users in to communicating with databases. A huge part of the web runs on it, including major platforms like WordPress, Joomla, Drupal, and Magento. So this warning isn’t just for big media websites. It affects ordinary company sites and tiny online stores too.

Older projects that nobody has touched in years are a particular concern. You can keep updating WordPress plugins until you’re blue in the face, while the server itself is still running an outdated PHP version. They’re two different things, and updating the CMS won’t save you here.

What Could Actually Happen

The worst part is the risk of attackers running their own code. If an attack gets through, the damage could be much worse than a website simply going down.

An attacker could alter page content, dump an entire database, or scatter web shells across the server. For an online store, that’s a straight path to leaking customer data. For a company, it could mean internal documents ending up in the wrong hands. And in the worst-case scenario, the entire server infrastructure could be compromised. By the way, security researchers at Cloudflare and Huntress have already spotted early warning signs and scanning attempts, so it’s definitely too soon to relax.

When to Expect a Fix and What to Do

The PHP team is preparing updates for October 21, 2026. Still, releasing patches won’t automatically make the problem disappear. Website owners will need to keep an eye on the threat, since any system left unpatched remains exposed.

Older PHP versions that have long since reached end of support are another headache. They won’t receive security updates anymore, so moving to a currently supported version will need to be part of the plan.

Where to Start Checking:

  • Find out your PHP version. Easy enough if you’re using a control panel like cPanel or Plesk. On a VPS, you’ll need to check through the command line or ask your hosting provider.
  • Make backups. Before changing anything, make sure you’ve saved both your files and database. Old code running on a newer PHP version can behave in unexpected ways.
  • Keep an eye on the logs. While patches aren’t available, watch for suspicious requests and make sure your backups can actually be restored.
  • Consider isolation. If you can’t update right away and the risks are high, temporarily blocking access to critical sections may be easier than dealing with the aftermath of a breach.