The PHP Fix from October 21: How to Tell If It Reached Your Site

Two critical PHP flaws were patched on 21 October. The useful question is not whether you are affected — it is whether the fix actually landed on your server, and why the version number may not tell you.

A critical PHP security fix shipped on 21 October, and the question I keep getting asked is the one that matters least. People want to know whether they are affected. The more useful question is whether the fix actually reached the server their site runs on — because on managed hosting you cannot see that from the outside, and in some cases the version number will not tell you either.

What shipped, without the drama

Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Both allow code execution without any login — an attacker needs to find your site, not a password. PHP released fixed versions the same day: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Several security firms have reported attack attempts since 17 October, four days before the flaws were public. As I write this, no source has published a confirmed successful compromise, and CISA has not listed either flaw as confirmed-exploited. That is not reassurance. It is the window you are currently inside.

"Am I affected?" has an annoying answer, and it does not change what you should do

PHP runs on a web server in one of a few ways, and the way yours runs changes the risk. The full remote-code-execution chain for the first flaw was demonstrated against Apache mod_php, where PHP is embedded directly in the web server process. The other common setup, PHP-FPM, blocks that particular chain because it kills the worker when a request fails to start. So mod_php is the highest-risk configuration, and most commentary stops there.

It should not. The second flaw's code execution is confirmed against PHP-FPM, through a different path. "We're on FPM" is not a pass. The honest summary: mod_php carries the highest risk, and every PHP below the fixed release should be patched regardless. So the interesting question was never which one you run — it is whether the patch landed.

How to check your version in about thirty seconds

In WordPress, go to Tools → Site Health → Info → Server. It reports the PHP version the site is actually running, which is the number you want — not what your hosting plan advertises. Compare it against the fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35. If you are on 8.3.35, you are one patch version behind the fix. If you are on 8.1 or older, that branch reached end of life and the situation is murkier, which brings me to the part most write-ups skip.

The two questions to ask your host, and why the version number can lie

Ask these in one message:

The first question matters because some hosts backport the fix as a source patch without moving the version number. On end-of-life branches this is common. A site showing 8.1.x could be patched or wide open, and the number tells you nothing either way. The second question matters because no external scan can determine it. A scanner can sometimes read a version header, if the host has not suppressed it. It cannot see how PHP is wired into the web server. Anyone telling you they scanned your site and know your exposure is telling you more than their tools can support.

If the answer comes back vague, that vagueness is your answer about how the server is being looked after.

Sweep before you patch, not after

This is the step I would most like people to take from this, and it is the one almost nobody mentions. Patching replaces the PHP binary. If someone already used the old one, you have just overwritten the thing you would have examined, and your site now looks healthy because the evidence is gone rather than because nothing happened.

So look first, while it is still there. Four checks, no specialist needed:

  1. New administrator or editor accounts you did not create.
  2. Plugins you do not recognise — particularly ones with plausible, boring, infrastructure-sounding names.
  3. Scheduled tasks that appeared recently.
  4. Files in your web root containing obfuscated code, which usually means a base64 decode wrapped around an execute call.

Then take a backup you have actually verified restores, then patch. That order is deliberate: look, preserve, change.

That is the order I used on our own servers. Our learning platform was the only PHP surface we run, it was on Apache mod_php — the highest-risk configuration — and it was patched the day after the fix was released, with an integrity sweep and a verified backup first, and under about ten seconds of downtime. The sequence is the point there, not the speed.

Check your version, ask your host the two questions, and look before you patch. If the host answers both clearly and the patch is already in, you are done — and you have learned something useful about your host. If the answer is that you only found out about this by reading about it, the flaw gets patched in an afternoon; the gap in who was watching does not.

Frequently asked questions

My host says they handled it. Do I need to do anything? Check the version yourself in Site Health → Info → Server. If it is at or above the fixed release for your branch, that confirms it. If it is below and they still say it is handled, ask specifically whether they applied a source patch without a version bump — that is a legitimate answer on end-of-life branches, and it is worth having in writing.

Can I just turn something off instead of patching? No. Workarounds circulated before the patch, including one involving memory limits, and the official release confirms none of them is a complete fix. Updating is the only full remediation.

How do I know whether my site was already hit? Not with certainty from the outside, which is why the sweep order matters. Run the four checks above before you patch over the evidence. No indicators of compromise have been published for these flaws yet, so there is no file hash to search for.