If your website runs on PHP, this week’s security news deserves attention. On 21 October 2026, the PHP project released security updates for two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP’s advice is simple: update immediately. Source
What happened this week?
On 20 October 2026, PHP published an advance notice warning that a critical security release was coming the next day. On 21 October 2026, the full advisory confirmed two severe flaws, each rated 9.2 under CVSS v4.0. Ubuntu’s summary notes that disclosure was brought forward after a public leak, which helps explain the speed and seriousness of the response. PHP advance notice Ubuntu summary
According to PHP, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisory adds that risk is considered highest for mod_php. Official advisory
Does this mean every PHP site is unsafe?
No. A website is not insecure simply because it uses PHP. The real question is whether it is being maintained properly.
Your level of risk depends on things like:
- the PHP version currently installed
- whether the latest patches have been applied
- whether the site is still on a supported PHP branch
- how the server is configured
- how dependent the site is on old plugins, themes or legacy code
- how quickly somebody responsible can patch, test and redeploy
PHP’s supported versions page shows that, as of 22 October 2026, the supported branches are 8.2, 8.3, 8.4 and 8.5. Older branches are end of life and should be upgraded as soon as possible. Supported versions
Why older websites are often more exposed
The biggest risk is usually not PHP itself. It is an ageing website stack that has become difficult to update safely.
Many business sites have grown over years through quick fixes, plugin additions and hosting changes. When a critical vulnerability appears, that sort of setup can become a problem very quickly. The business may not know what version it is running, who is responsible for updates, or whether applying a patch will break something important.
That is why maintainability matters. A good website build is not only about appearance or features. It should also be straightforward to patch, test and support under pressure.
What about WordPress?
This is a PHP issue, not a WordPress flaw. But WordPress is relevant because many WordPress websites depend on PHP underneath, and WordPress.org highlighted the PHP release to its users. WordPress news
The wider lesson is that any site with several layers of dependency needs disciplined maintenance. That includes the core language, the CMS or framework, extensions, hosting environment and deployment process.
What should website owners do now?
- Check your PHP version
Confirm whether your site is running one of the patched releases or an earlier vulnerable version. - Apply updates immediately
PHP’s release announcement says affected users should update to the latest versions. Release announcement - Review whether your branch is supported
If you are on an end-of-life version, this is a warning that the stack needs more than a quick patch. - Audit the wider site setup
Outdated plugins, themes, admin tools and poor server configuration can still leave the site exposed elsewhere. - Check who owns ongoing maintenance
If the answer is unclear, that is a risk in itself.
The bigger lesson for custom builds and modern stacks
This does not prove that every custom-built website is automatically safer than every CMS-based one. That would be too simplistic. But it does show why modern, well-supported builds are often easier to secure over time.
A leaner custom site, built with current technology and a sensible deployment process, can be easier to maintain because there are fewer unnecessary dependencies, clearer ownership and less hidden complexity. The same is true of carefully built WordPress sites with proper maintenance discipline. What matters most is not the label. It is the quality of implementation.
If a website has become brittle, opaque or tied to old components, every urgent patch becomes harder than it should be. If it is well planned and properly supported, security updates are still inconvenient, but they are manageable.
That is one reason businesses sometimes move from older, plugin-heavy setups to more maintainable builds or structured rebuilds. If your current site feels fragile, a website rescue, ongoing website support or a planned WordPress website rebuild may be the safer long-term decision.
Final thought
The latest PHP vulnerabilities are a useful reminder that website security is never “done”. Critical issues can appear suddenly, and the difference between a minor maintenance task and a serious business risk often comes down to how well the site was built and how quickly it can be updated.
If you are unsure what your website is running, whether it is supported, or how resilient it would be during the next security scare, it may be time for a proper review. Glue Web Design can help with that through practical audits, rebuilds and support, starting with a clear look at what your current setup is actually doing. See our services or get in touch.
