Cybersecurity 
Does your business need to act?
If your website or application uses PHP, ask your hosting provider or developer to confirm which fix has been applied. Fixes for CVE-2026-109618 and CVE-2026-109619 were released on 21 October 2026. A normally functioning site may still need verification. Identify exposed environments, address those affected and keep evidence of the work completed.
Three decisions to make
- 01Identify the services actually running PHP and who maintains them.
- 02Obtain the active version or vendor package reference for each environment.
- 03Recheck essential journeys after changes and agree on follow-up.
01
What was announced on 20 and 21 October 2026?
Following an advance notice on 20 October, PHP security fixes were released on 21 October. Both vulnerabilities can allow unauthenticated remote code execution. CERT-EU updated its advisory after the fixed releases became available.
This overview was checked on 22 October 2026. A published vulnerability does not establish that a particular site has been compromised. An older screenshot announcing an upcoming fix should not replace the publisher’s current information.
Sources consulted
02
Which PHP releases fix these vulnerabilities?
The updated advisory lists four fixed releases. A branch number such as PHP 8.4 is insufficient: obtain the precise active version or the vendor package installed.
Distributions and LTS suppliers may provide their own patched packages. For an older branch, confirm available support and an upgrade path. Compare scanner findings with the supplier’s fix reference.
| PHP branch | Announced fixed release | Evidence to request |
|---|---|---|
| 8.5 | 8.5.12 | Active version or vendor reference |
| 8.4 | 8.4.27 | Active version or vendor reference |
| 8.3 | 8.3.36 | Active version or vendor reference |
| 8.2 | 8.2.35 | Active version or vendor reference |
03
WordPress, business apps and portals: build the right inventory
A CMS name does not describe the complete technology stack. A company may run a public website, store, customer portal and administration tools across several providers. Establish who maintains each service and which runtime it uses.
ENISA recommends identifying PHP-based applications, coordinating updates with suppliers and prioritising internet-facing systems. Some products include PHP without this being obvious to their users.
| Record | Useful information |
|---|---|
| Service and purpose | Website, store, portal or internal tool |
| Environment | Hosting, server or managed service; production and staging |
| Owner | Who can confirm the runtime and apply the fix |
| Verified status | Fix, date, evidence and outstanding action |
Sources consulted
04
Five answers to request from your hosting provider or agency
Turn the alert into an environment-specific status report. A general statement that a provider is monitoring events may not establish whether your own website has been treated.
Use this checklist to organise responsibility and evidence. It does not run an automated diagnosis or issue a security certificate.
05
HTTPS and web firewalls: understand their role
HTTPS protects traffic; its presence does not attest that PHP is patched. A web application firewall can contribute to protection, but should not be presented as proof that these vulnerabilities have been removed.
PHP describes updating as the complete solution and explains limitations of temporary measures. Ask the environment’s owner to assess their relevance and impact while keeping remediation a priority.
Sources consulted
06
What if the fix cannot be applied immediately?
ENISA recommends considering isolation of exposed applications when immediate remediation is not feasible. Technical and business owners should examine the affected services, consequences, communication and conditions for restoring access.
Prepare functional checks for recovery too: a validation order for a store, or sign-in and document access for a portal. Returning online should rely on verified evidence rather than the end of a maintenance window alone.
Sources consulted
07
After the urgent fix: organise maintenance and security review
Use the alert to clarify who follows dependencies, servers, accounts and product changes. A maintenance agreement should name the environments, interventions and verification arrangements it covers.
Gaspa can scope web security requirements and follow-up for businesses in Belgium. Describe the services and available access arrangements in the first conversation. Never put passwords or production secrets in the enquiry form.