Updated October 22, 2026. Businesses with PHP-powered websites or web applications should urgently confirm that their hosting environment has received the latest security fixes. The PHP project released updates on October 21 addressing CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can permit unauthenticated remote code execution. See the PHP security advisory.
For San Diego business owners, the immediate task is to identify who manages the server runtime and obtain a clear patch status. A working homepage, an updated plugin list or a reassuring hosting dashboard does not by itself verify that the running PHP workers have been updated. This guide separates the published facts from practical steps your business can coordinate with its provider.
What happened, in plain English?
PHP is software that runs server-side application code. The first flaw concerns unsafe handling of an out-of-memory condition; the second involves stale internal state retained between requests. The PHP maintainers describe them in their out-of-memory advisory and stale-state advisory. This is a runtime issue, rather than a flaw limited to one WordPress plugin.
The Canadian Centre for Cyber Security alert identifies both issues as critical, with CVSS scores of 9.2. Potential impact is serious, but the disclosure does not establish that your organization has been breached. Exposure and evidence of compromise need separate evaluation.
Which systems need attention?
The PHP project advises all installations serving web requests to update, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration. Check business websites, customer portals, older applications, staging sites and overlooked subdomains. Do not assume one hosting account means every application runs the same runtime.
A WordPress site can depend on a vulnerable PHP runtime even when its theme and plugins are current. Conversely, a site built without PHP is not automatically affected by these PHP flaws; its integrations and hosted applications still need an inventory. SaaS customers should request a vendor statement about the service they use rather than attempt to modify the vendor’s infrastructure.
Which PHP releases contain the fixes?
The patched releases listed in the maintainers’ security advisories are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use the fixed release for your supported branch or a later supported release containing the fixes. Your Linux distribution or commercial support vendor may backport a fix into its own package, so record the package advisory as well as the displayed version.
PHP 8.1 and earlier are outside normal upstream support. The PHP announcement mentions limited source backports and possible distribution or LTS vendor fixes; these are not a return to routine upstream support. Ask for documented coverage or plan migration to a supported branch. Do not select a major-version upgrade without checking application compatibility.
A practical response checklist for business owners
1. Assign an owner. Identify the hosting company, developer or IT provider responsible for each application. Ask: “Does this service use PHP, which runtime and package is deployed, and have both CVEs been addressed?” Request a written answer tied to the actual service, not a general statement about the hosting platform.
2. Prepare recovery and access. Confirm that backups exist, who can restore them, and who authorizes an emergency maintenance window. Keep administrative access available through your established secure process. Avoid sending credentials through email or a public contact form.
3. Apply the appropriate runtime update. Have the responsible administrator follow the PHP and platform-vendor instructions, including required worker restarts or container redeployment. Google Cloud’s response guidance illustrates why a patched base image may still require rebuilding or redeploying an application, depending on the service configuration.
4. Verify the result. Confirm the runtime serving web traffic, not only the command-line PHP installation. Test logins, forms, uploads, checkout and other business-critical workflows that apply. Record the package or image version, completion time, administrator and test results.
5. Review suspicious activity. Ask the security owner to examine relevant logs, unusual file changes and unexpected accounts. Patching fixes the vulnerability; it does not establish that an earlier compromise has been removed. Escalate credible indicators through your incident-response process.
If an update cannot be completed immediately
The PHP project states that configuration changes only reduce exposure to particular paths and do not provide a complete solution. Do not treat a firewall rule or a plugin update as evidence that the PHP runtime is fixed. Have the technical owner review the current advisory and decide whether to restrict access or temporarily isolate the affected service while patching is completed.
Business owners should not copy emergency server settings into production without understanding their effect on availability and application behavior. Document the temporary control, its owner and the deadline for the permanent update. Recheck the advisory as guidance evolves.
What San Diego organizations should ask their provider today
Request an inventory of PHP-dependent services, confirmation covering both CVEs, the fixed package or image reference, and the restart or deployment evidence. Ask which systems remain unresolved, who owns the next action and when you will receive an update. Include a summary of any post-update functional checks and security findings.
For firms coordinating multiple websites, offices or vendors across San Diego County and California, a shared responsibility list is often more useful than several disconnected assurances. Your website agency, hosting company and managed IT provider should agree who patches, who tests and who communicates service interruptions.
Get help organizing the response
Mytek Pros supports businesses in San Diego County and across California with technology planning and IT services. Contact our team to discuss an inventory and assessment, coordinate hosting-provider questions, or review your ongoing managed IT needs. Scope and access requirements depend on your actual environment.
This article reflects the linked advisories reviewed on October 22, 2026. It is not a finding about any particular customer’s systems. Use the current PHP and platform-vendor advisories when carrying out technical changes.