Critical Security Vulnerabilities in PHP – October 2026 Emergency Update
Two particularly serious security vulnerabilities have been discovered in the core of PHP, one of the most popular programming languages used for running websites and web applications.
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been rated as critical, with a severity score of 9.2/10 (CVSS v4.0).
On October 21, 2026, the official PHP development team released urgent security updates to address these issues.
What exactly happened?
These vulnerabilities do not concern a specific WordPress plugin or theme, but the PHP core itself.
Under certain conditions, they can allow malicious users to perform remote code execution (RCE) without prior authentication.
This makes timely application of the necessary security patches extremely important.
Which PHP versions have been fixed?
The official PHP development team has released the following security updates:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
For older PHP versions, it is necessary to check for available updates from your infrastructure provider or upgrade to a supported version.
Are WordPress and WooCommerce websites affected?
Yes, potentially. WordPress and WooCommerce rely on PHP to operate.
Even when WordPress, plugins, and themes are fully updated, the application still depends on the security of the PHP version running on the server.
This does not mean every website has been compromised, but administrators must ensure the appropriate security patches are applied.
Why is server-level protection important?
The security of a website depends not only on the application itself but also on the infrastructure hosting it.
At Domain Market, we utilize technologies and protection mechanisms such as:
- CloudLinux: Account isolation and hosting resource management.
- Imunify360: Enhanced protection against malicious activity.
- ModSecurity: Web Application Firewall rules protecting web applications.
- Security updates: Addressing known vulnerabilities in server software.
- Backups: Supporting data restoration when needed.
These mechanisms provide multiple layers of protection but do not replace the installation of official PHP security patches.
What should website owners do?
- Check the PHP version their website is using.
- Confirm that the necessary security patches have been applied.
- Keep WordPress, WooCommerce, plugins, and themes updated.
- Maintain recent backups.
- Avoid changing the PHP version without prior compatibility checks.
- Contact their hosting provider for clarifications regarding their service protection.
Security is a priority for Domain Market
At Domain Market, we believe reliable hosting is not limited to website speed and performance.
Protecting infrastructure, proper server management, monitoring new threats, and timely vulnerability mitigation are key elements of a comprehensive hosting service.
The recent PHP vulnerabilities highlight the importance of continuous maintenance and proper management of the hosting environment.
Need more information?
For any clarifications regarding your hosting service, you can contact the Domain Market technical support team.
Domain Market – Reliable hosting with a focus on security.
Official sources
Published: October 21, 2026
