PHP security updates: what website owners need to know
PHP security updates fix vulnerabilities in software used to run many websites. They can matter even when your website looks normal and your WordPress or Joomla dashboard shows no updates waiting.
Recent PHP security advisories are a useful reason to check what is running behind your website. You don’t need to understand the technical details yourself, but it helps to know what to ask your hosting provider or web developer.
What is PHP?
PHP is a programming language used on the server to run websites and applications, including WordPress and Joomla. It helps process the code behind the pages and features visitors use.
Your content management system, themes and extensions run within that environment. Updating those parts of the website and updating PHP are separate tasks.
For example, installing a WordPress update does not, by itself, change the PHP version selected for your hosting account.
What happened in October 2026?
On 21 October 2026, the PHP team published security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
The advisory explains that the vulnerabilities could allow an attacker to run code on an affected server without logging in. A CVE number is a reference used to identify a particular security vulnerability.
PHP published fixes and subsequently issued further configuration-specific guidance on 23 October. The official PHP advisory contains the details for hosting providers and technical teams to check against their setup.
The announcement does not mean every website has been compromised. It does mean the relevant software and patch status need checking.
Updating your website and updating its hosting
Website maintenance involves several layers. Keeping one part current does not automatically update everything else.
| Part of the setup | Examples of what needs attention |
|---|---|
| Website software | WordPress or Joomla, themes, plugins and extensions |
| Hosting environment | PHP and other server software |
| Website functions | Forms, logins, checkout and other features that need testing after changes |
Responsibility depends on your hosting and support arrangements. Your developer may manage the website itself while the hosting provider maintains the server software. In other cases, one company coordinates both.
If you are reviewing your website hosting and support arrangements, ask who handles each part so there is no uncertainty when a security update is released.
How can you check whether your website needs attention?
Ask your hosting provider or web developer to check the PHP version serving your website and whether the relevant security fixes have been applied.
A useful set of questions is:
- Which PHP version is this website using?
- Have the fixes relevant to the October advisories been applied?
- Is that PHP version still receiving security support?
- Is any further action needed for this hosting setup?
- Who is responsible for applying updates and checking the website afterwards?
The displayed version number is useful, but it may not tell the whole story. Some hosting vendors apply security fixes to their existing packages, so the provider should confirm the patch status rather than relying on the version label alone.
Supported versions and future updates
PHP versions have a support lifecycle. Once a branch reaches the end of its official support, it no longer receives fixes from the PHP project.
As of November 2026, PHP 8.2 is due to reach the end of its security support on 31 December 2026. If your website uses it, discuss an upgrade plan alongside checking the current security updates. PHP publishes the dates on its supported versions page.
Checking the website after a change
An update should be followed by checks of the features your business relies on. Before a planned version change, make sure there is a usable backup and consider compatibility with the website’s software.
Afterwards, test the important journeys. For a service website, that might include submitting a contact form and confirming the message arrives. For an online shop, it includes the relevant checkout and order functions.
These checks help identify problems that may not be obvious from looking at the homepage.
Unsure whether your website is affected?
If you’re unsure which PHP version your website uses or whether these updates apply, contact Swindon Web Creations. We can help you understand what needs checking and discuss any next steps.
