The PHP vulnerability of 21 October: how we handled it without a single client noticing
3 min readBy the Verploy team
On Tuesday 21 October the PHP team shipped an emergency release for two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. They allow an attacker to run code on a web server without logging in. Almost every WordPress site runs on PHP, so this touched sites everywhere.
What made it worse: details leaked before the fix was out, and attacks were reported that same morning. Some hosting providers chose to take their web hosting offline or switch PHP off until they had patched.
The solution: what to do now
Four steps. The first one closes the hole, the others make sure your sites stay safe and you know it.
- Patch PHP on the server. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Managed or shared hosting: ask your host to confirm the 21 October fix is in place (some hosts fix older versions without changing the version number). Your own server: update PHP and restart PHP-FPM or your web server.
- Know which sites need it. Verploy shows the PHP version of every site you connect and flags versions that no longer get security updates, such as PHP 7.4. One list, instead of logging in to every site.
- Move sites off PHP 8.1 and older. These versions get no official fix. Verploy’s PHP upgrade check shows per site what blocks the move to a supported version, and in which order to solve it. Every site gets a backup first.
- Keep watching after the patch. Verploy checks every site every minute, reports PHP errors on the live site, and with Verploy Connector 2.19 or newer scans the PHP files every night for clear signs of malware such as web shells. So if something did get in before you patched, you hear about it.
Not sure where to start? Email team@verploy.com and we help you check your sites.
Check your sites for free →Free for up to 3 sites, no credit card.
Why a WordPress update does not help
The hole is in PHP on the server, not in WordPress, a plugin or a theme. Updating WordPress changes nothing here. The fix is a new PHP version on the server: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer get official fixes, so sites on those versions need to move to a supported version.
What we did
Verploy grew out of our own agency, EM Hosting & Design, and our client sites run on it every day. This is how the day went for us:
- We were already watching. Verploy checks every site every minute for reachability and reports PHP errors on the live site. That monitoring runs all the time, not only on a day like this, so we did not have to start from scratch. It gave us no signals of trouble on our sites.
- We patched as soon as the fix was out. Our own servers were updated to the patched PHP versions right after the release.
- We helped clients who host their own site. Where a client manages their own hosting, we moved their site to the right PHP version straight away, as a service, at no cost.
- Nothing had to go offline. Because we could see that the sites were fine and patched quickly, none of our sites had to be taken offline as a precaution. Not a single client noticed anything.
What you can check today
- Look up the PHP version of each site (in WordPress: Tools → Site Health → Info → Server) and compare it with the patched versions above.
- Some hosting providers fix older PHP versions themselves without changing the version number. If in doubt, ask your host whether the October 21 fix is in place.
- Sites on PHP 8.1 or older: plan the move to a supported version. Verploy’s PHP upgrade check shows what is blocking that move on each site.
Monitoring does not replace patching. But it does mean you can make a calm decision on a day like this, instead of switching everything off.
Want the same calm on your own client sites? Verploy is free for up to three sites.
