PHP security is an important concern for website owners following reports of two critical vulnerabilities affecting PHP, a programming language widely used by websites and WordPress applications.
Reported on 22 October 2026, the vulnerabilities have raised concerns among website owners, businesses and organisations worldwide. The PHP development team has released security updates to address the issues, making it important for website administrators to review their hosting environments and ensure their websites are running patched PHP versions.
At Zoewebs, we encourage businesses to take a proactive approach to website security. Although the discovery of a vulnerability does not mean every website will be hacked, timely updates can help reduce avoidable security risks.
What Are the PHP Security Vulnerabilities?
The reported security issues, collectively referred to as PHP2Shell, are identified by the following Common Vulnerabilities and Exposures (CVE) numbers:
- CVE-2026-109618
- CVE-2026-109619
According to security advisories, these vulnerabilities affect the PHP runtime itself. Under vulnerable conditions, an attacker could potentially execute malicious code remotely on an affected server without authentication.
Depending on the circumstances and the level of access obtained, successful exploitation could lead to unauthorised access to sensitive information, website disruption or further compromise of the affected server.
PHP is widely used for business websites, content management systems, e-commerce platforms and other online services. This makes it important for website owners to identify their PHP versions and apply the appropriate security updates.
For further reading, see the reports from The Star, Sin Chew Daily and Reddot News.
Which PHP Versions Should Website Owners Use?
The PHP development team released security updates on 21 October 2026 to address these vulnerabilities.
The following patched releases have been identified in the official PHP security announcements:
| PHP branch | Patched release |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
Website owners should ensure they are using the appropriate patched release for their PHP branch, rather than assuming that any PHP 8.x version is secure.
Important: PHP 8.2 is approaching the end of its upstream security support on 31 December 2026. Where compatibility permits, businesses should plan to migrate to a newer, supported PHP branch instead of relying on PHP 8.2 for the long term.
The appropriate version depends on the hosting environment and the website’s technical requirements. A PHP upgrade should be accompanied by compatibility checks for the website’s CMS, themes, plugins and custom code.
For the latest technical information, refer to the official PHP security announcements.
Does This Mean Your Website Will Be Hacked If You Do Nothing?
Not necessarily.
A reported vulnerability does not mean every website using an affected PHP version will be compromised. The actual risk depends on factors such as the PHP version, server configuration, exposure to the internet and whether an attacker can successfully exploit the vulnerability.
However, leaving a known vulnerability unpatched can expose a website to unnecessary risk, particularly when technical details and potential attack methods become publicly available.
Prevention is better than cure. Updating promptly, checking website compatibility and maintaining appropriate security measures can help businesses reduce their exposure to cyber threats.
Website owners should also remember that a website can appear to be working normally while still requiring security updates. The absence of visible problems is not proof that a website is secure.
What Is Zoewebs Doing to Help Protect Websites?
At Zoewebs, we recognise the importance of maintaining secure and compatible website environments.
Our approach includes the following measures:
1. PHP Security Updates for Managed Hosting Environments
We will review the PHP environments under our hosting management and ensure that applicable security updates are addressed, including the patched PHP 8.2–8.5 releases where relevant.
Updates will be applied according to the hosting environment, software compatibility and applicable maintenance arrangements.
2. Website PHP Compatibility Checks
We advise clients to keep their websites compatible with current, supported PHP versions. Before upgrading, the website’s WordPress installation, themes, plugins and any custom functionality should be reviewed to reduce the likelihood of errors or service interruptions.
3. WordPress Plugin and Theme Maintenance
Outdated plugins and themes can introduce separate security risks or compatibility issues. Keeping these components updated helps maintain a healthier website environment.
However, plugin updates alone do not fix vulnerabilities in the PHP runtime. The server’s PHP installation must also receive the appropriate security updates.
4. Ongoing Website Maintenance
Regular maintenance helps identify outdated software, compatibility concerns and other issues before they become more serious. Businesses should consider website security an ongoing responsibility rather than a one-time task.
What Should Website Owners Do Now?
If you own a business website, we recommend taking the following steps:
- Check your current PHP version. Confirm the version used by your actual hosting environment, not just the version available in your hosting control panel.
- Apply the relevant PHP security update. Use the appropriate patched release or a verified security update provided by your hosting vendor.
- Review website compatibility. Test important pages, forms, checkout processes and integrations after upgrading.
- Update WordPress, themes and plugins. Install appropriate stable updates and remove software that is no longer needed.
- Maintain backups and monitoring. Keep reliable backups and review unusual website or server activity.
- Plan ahead for older PHP versions. If your website depends on an older or unsupported release, arrange a compatibility assessment and upgrade plan.
If an immediate upgrade is not possible, consult your hosting provider or website developer about suitable temporary risk-reduction measures. Temporary mitigations are not a substitute for applying the proper security patch.
Protect Your Website Before Problems Arise
Your website is an important business asset. It supports your brand, communicates with customers and may handle enquiries, personal information or online transactions.
Keeping it secure requires more than choosing a hosting package. PHP, the content management system, plugins, themes and server configuration all play a role.
Zoewebs encourages all website owners to review their current PHP version and maintenance arrangements. If your website requires an upgrade, we recommend assessing compatibility and planning the update before it becomes an urgent operational issue.
Need help reviewing your website’s PHP version or planning a safe upgrade?
Contact Zoewebs to discuss your website maintenance, PHP compatibility and security update requirements.
Disclaimer: This article provides general website security information based on publicly available reports and security advisories as of 23 October 2026. No security measure can guarantee that a website will never be compromised. Website owners should consult their hosting provider or qualified technical team for advice specific to their environment.
