Two critical vulnerabilities in PHP have come to light. PHP is the programming language behind WordPress, Joomla, Drupal and Magento, among others. The PHP security team has scheduled a patch for today at 16:00 CEST (14:00 UTC). As soon as it is available, we install it on the PHP environments we manage as quickly as possible. This article explains what is going on and what you can do yourself.
What is going on?
There are two flaws in PHP itself, known as CVE-2026-109618 and CVE-2026-109619. Both carry the official severity score of 9.2 (critical). An attacker may be able to use them to run their own code on the web server.
The details leaked on 20 October, a day before the planned disclosure. Security company Patchstack reports exploitation already seen at several hosting providers. Other researchers have not yet confirmed exploitation. We assume attackers are actively looking for vulnerable sites.
Who is affected?
Because the flaw is in PHP and not in a plugin or theme, every website on a vulnerable PHP version is affected. That includes WordPress, but also Joomla, Drupal, Magento, Laravel and custom PHP applications.
PHP will publish exactly which versions are vulnerable today, together with the patch. According to early reports, only supported versions (PHP 8.2 and later) will receive a patch. If your site runs on PHP 7, 8.0 or 8.1, a fix will most likely never come and an upgrade to a newer version is needed.
What Universal.Cloud is doing
- Patching as soon as possible: once the patch is available, we install it as quickly as possible on all PHP environments we manage for customers.
- Older PHP versions: if an environment we manage runs a version without a patch, we will contact you about an upgrade or temporary shielding.
- Our own website and sites on uCompose: these are static and do not run on PHP. They are not affected.
What you can do yourself
- Check which PHP version your site runs on, including test and staging environments. In WordPress, you can find this under *Tools > Site Health > Info > Server*.
- Ask your hosting provider when they will patch, if your site is not managed by us.
- Consider a temporary maintenance mode until the patch is installed, especially if you notice suspicious activity. For supported PHP versions, this is a matter of hours.
- Shield admin environments: temporarily make login pages and internal PHP applications reachable from trusted networks only.
- Do not use unofficial "fix" plugins or copied code snippets. Wait for the official patch.
- Using UpdraftCentral? Separately from this PHP flaw, stolen UpdraftCentral keys are being used to plant backdoors in WordPress sites. Delete existing keys and create new ones if needed.
Questions?
Not sure whether your website is vulnerable, or want help checking or upgrading? Contact our service desk at support@universal.cloud. We will update this article as soon as PHP publishes the official details.
Want to depend less on updates like this in the future? Read why static websites are inherently more secure than a CMS. With uCompose, you manage a static website without PHP, a database or plugins: you describe changes in plain language and publish with one click. Universal.Cloud converts your current website to this secure environment within 48 hours. Email us at support@universal.cloud to discuss the options.
