Critical PHP Security Flaws: What to Ask Whoever Runs Your Website
This week, the group that maintains PHP released fixes for two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the software behind most business websites, including every WordPress site. Most business owners will never hear about an issue like this, so here is what it means and what to do about it.
The short version: the fixes exist, but a website only benefits once whoever hosts it has installed them.
What Happened
The flaws could allow an attacker to run their own code on a web server. Early attacks have been reported, though that is not yet confirmed. Security teams treat this kind of flaw seriously because it can give an attacker control of the server, and everything on it.
Who Needs to Act
Probably not you directly. Many hosting companies apply security fixes for their customers, and some have already done so. The person to ask is whoever hosts or maintains your website: your hosting company, your web designer, or your IT provider.
The Question to Ask
Send them this:
“Does the PHP version on our website include the fix for CVE-2026-109618 and CVE-2026-109619?”
A good answer is a clear yes, with a date. A vague answer, or no answer, is worth following up on.
One Detail Worth Knowing
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older will not receive a fix, so a site still running one of those needs to be upgraded rather than patched. Some hosts also protect sites in other ways, such as blocking known attack patterns, which is why asking the question matters more than guessing from a version number.
What About Our Clients?
We’ve reviewed our clients’ websites and have ensured they have been patched or otherwise mitigated as needed.
Not Sure Who Looks After Your Website?
If you do not have someone handling this, Atech Business Services can help. We can contact your host, get written confirmation of the patch status, and manage ongoing updates if you would like that.
Schedule a complimentary consultation, or call 877-678-0155. If you already have this covered, no action is needed.
