Important PHP security update: What website owners need to do

PHP, the programming language behind most of the web, released an emergency fix for two critical vulnerabilities on Wednesday, October 21, 2026 at 15:00 BST. If your server, website or web application runs on PHP, update as soon as you can. This article explains what’s happening and what you need to do.

Note: This is an industry-wide vulnerability in the open-source PHP language that affects all hosting providers. It is not specific to 123 Reg.

What is the vulnerability?

The PHP security team has released fixes for two flaws, both rated Critical (CVSS v4.0 9.2). Both are remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. A flaw like this could let an attacker run their own code on an affected server over the internet, which can lead to stolen data, a defaced site, or a full takeover.

PHP says the flaws affect PHP 8.5, 8.4, 8.3 and 8.2, as well as older unsupported versions. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Full technical details are in PHP’s security release announcement.

Is my site affected?

If you use PHP, you may be affected. What you need to do depends on where your site is hosted.

• Managed Hosting for WordPress: We have patched all PHP versions. You don’t need to take any action.
• Windows Hosting: We have patched all PHP versions. You don’t need to take any action.
• Web Hosting: We have the patched PHP packages from our vendor and are deploying them to all Web Hosting servers now. Mitigations remain in place until the deployment is complete. You don’t need to take any action.
• VPS: Since you manage your server’s software, you’ll want to update PHP yourself. The steps below walk you through it, or our Expert Services team can do it for you.
• Hosted with another provider: Check with your provider. If you manage your own server, follow the steps below.

If you manage your own VPS server

• Sites and apps running PHP (WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, and others): Assume yes, until you have updated to the fixed release.
• Sites running PHP 8.1 or older: PHP no longer supports these versions and will not release an official fix for them. Some providers have backported the fix, including cPanel’s EasyApache 4 packages for PHP 7.4, 8.0 and 8.1. Even so, plan to upgrade to a supported version (8.2 or later).

Follow the “Once the fix is available” section below, which at a high level will require you to:

1. Update PHP to the fixed release for your version.
2. If you manage your own server, restart PHP and your web server so the update takes effect.
3. Verify that your site is running the updated version.

PHP publishes the fix first. Operating system vendors, control panels, and hosting providers then release their own updates on their own schedules. Check the latest status here:

• PHP security release announcement
• cPanel EasyApache 4 change log
• Overview from Ars Technica
• Guidance for WordPress sites from Wordfence

If you can’t update right away

PHP has published temporary mitigations for both vulnerabilities in its security release announcement. PHP describes them as incomplete. Installing the fixed release is the only complete fix. While you prepare to update:

1. Find every site and server you run on PHP. Note which PHP version each one uses.
2. Review PHP’s published mitigations. Some of them change PHP settings that can affect how your site works, such as file upload limits or upload progress bars. Test your site after any change.
3. Turn on automatic updates where available so you get the fix as soon as it reaches your system.
4. Take a backup or snapshot of your site before you update so you can roll back if needed.

Once the fix is available

Take a backup first, then update PHP to the fixed release for your version.

• How to change your PHP version in cPanel
• How to change your PHP version in Plesk
• If you run cPanel/WHM on a VPS, install the updated ea-php packages through EasyApache 4 in WHM. See cPanel’s EasyApache 4 change log.

How to confirm you are protected

After updating, check your PHP version:

On WordPress, you can also find your PHP version under Tools > Site Health > Info > Server.

Compare it against the fixed versions below. If your site is running that version or newer, you are protected. If you run more than one PHP version, check each one.