*Last updated: 21 October 2026, 17:15 CEST*
Two critical vulnerabilities in PHP have come to light. PHP is the programming language behind WordPress, Joomla, Drupal and Magento, among others. The PHP security team released a patch today. We installed it straight away on the PHP environments we manage. This article explains what happened, what we did and what you can do yourself.
What is going on?
There are two flaws in PHP itself, known as CVE-2026-109618 and CVE-2026-109619. Both carry the official severity score of 9.2 (critical). An attacker may be able to use them to run their own code on the web server.
The details leaked on 20 October, a day before the planned disclosure. Security company Patchstack reports exploitation already seen at several hosting providers. We assume attackers are actively looking for sites that have not been patched yet.
Who is affected?
Because the flaw is in PHP and not in a plugin or theme, every website on a vulnerable PHP version is affected. That includes WordPress, but also Joomla, Drupal, Magento, Laravel and custom PHP applications.
Only supported versions (PHP 8.2 and later) receive a patch. If your site runs on PHP 7, 8.0 or 8.1, a fix will most likely never come and an upgrade to a newer version is needed.
What Universal.Cloud did
- Platform shut down as a precaution: in line with government advice, we temporarily shut down our WordPress platform until the patch was available. We informed affected customers by email.
- Patched straight away: as soon as the patch was released, we installed it on all PHP environments we manage for customers and brought the WordPress sites back online.
- Older PHP versions: if an environment we manage runs a version without a patch, we will contact you about an upgrade.
- Our own website and sites on uCompose: these are static and do not run on PHP. They are not affected.
What you can do yourself
- Is your site not managed by us? Ask your hosting provider whether the patch has been installed, including on test and staging environments.
- Check your PHP version. In WordPress, you can find this under *Tools > Site Health > Info > Server*. If you run PHP 8.1 or older, plan an upgrade.
- Watch for unusual changes on your website, such as unknown users, pages or plugins, and report them to us.
- Do not use unofficial "fix" plugins or copied code snippets. Only the official patch fixes the flaw.
- Using UpdraftCentral? Separately from this PHP flaw, stolen UpdraftCentral keys are being used to plant backdoors in WordPress sites. Delete existing keys and create new ones if needed.
Our advice: move to a static website
The patch fixes this flaw, but the next vulnerability in PHP, WordPress or a plugin is sure to come. Each time that means patching again, running a risk and sometimes even going offline. Our advice therefore remains to move to a static HTML website. A static site has no PHP, no database and no plugins, and so none of these attack surfaces. Read why static websites are inherently more secure than a CMS.
With uCompose, you manage such a static website yourself: you describe changes in plain language and publish with one click. Universal.Cloud converts your current website to this secure environment, guaranteed within 48 hours and often within one day. In recent weeks we did this for a construction company, a logistics organisation, a consultancy firm and a retail organisation, among others. Read how we convert WordPress to a static website in one day.
Questions?
Not sure whether your website is vulnerable, or want to move to a static website? Contact our service desk at support@universal.cloud.
