Skip to content
Start free trial
Menu
Sign inFree scanStart with your public exposureAttacker’s View™Who it’s forFor MSPsOne security assessment tool for every clientPricingTrustProduct overviewFrom security findings to a clear action planMicrosoft 365Identity, email, sharing, apps, and devicesAzure securityReview your cloud configuration and exposureVulnerability WatchAdvisories matched to your technologyInsurance evidenceUnderstand what supports your answersAI assistant · BetaExplore your evidence in plain languageDemo videosSee the product before you sign upGuides & insightsPractical security reading
← Blog

Two critical PHP flaws: how to check whether your website is affected

Tenant Strike2 min read
Small businessTrends

On October 21 the PHP project fixed two flaws that let a stranger run code on a web server without signing in. Here is how to tell whether your website needs the update, and a free check that reads its PHP version for you.

On October 21 the PHP project released an urgent security update. It fixes two flaws, CVE-2026-109618 and CVE-2026-109619, that can let someone run their own code on a web server without signing in to anything. The PHP team asks everyone running PHP to update immediately.

PHP is the programming language many websites are built in, WordPress among them. Both flaws are in PHP itself, not in a plugin or a theme, so keeping WordPress up to date doesn't cover this. The PHP project says every PHP set up to serve web pages is at risk, and that a working attack has been shown against one common setup, where a single request triggers it before the website's own code even runs.

Check your website for the PHP vulnerability, free →

The fix is a newer PHP, and it usually belongs to your host.

The first releases with the fix are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get fixes from the PHP project, so a site on one of those needs to move to a supported version.

Two things make this less clear-cut than a version number suggests. Linux distributions and long-term support vendors got the patches before the announcement, and they often fix PHP without changing its number, so an older-looking version can already be patched. And hiding the version number from visitors fixes nothing.

Three ways to find out.

  1. Run the free PHP vulnerability check. It reads the PHP version your website announces and compares it with the fixed releases. It also flags a website that runs PHP but hides its version, and the rest of the free outside-in scan runs alongside it. It never tries either flaw against your server: confirming one that way would mean attacking it.
  2. Look in your hosting control panel. Most hosts show the PHP version for each site. You're looking for one of the four versions above or later.
  3. Ask your host or web person by name: "Is our PHP patched for CVE-2026-109618 and CVE-2026-109619?" Someone on top of it can answer in one line.

Check your website for the PHP vulnerability, free →

The PHP vulnerability page has the fixed versions and what each result of the check means.

Share this:LinkedInX / Twitter

AI-researched from public sources. We label AI-assisted writing — see our trust page.

See your own risk

Want this for your own Microsoft cloud?

Tenant Strike finds the security gaps in your Microsoft 365 and Azure, shows how they chain into a real break-in, and hands you a plain-English fix for every one — read-only, and it never asks for permission to change anything. Start a 7-day Pro trial — no credit card.

Start 7-day Pro trialSee pricing