Get relevant IT updates by email →
PHP security update — October 2026: Website owners should ask their maintainer whether every web-serving PHP runtime has received the relevant security fixes. The PHP project released updates on 21 October and a follow-up session-upload notice on 23 October. This advisory explains the business questions to raise; it does not certify any individual website as secure.
Who Is Affected By The PHP Security Update?
The PHP project’s official advisory identifies web-serving PHP installations as at risk from CVE-2026-109618 and CVE-2026-109619. These vulnerabilities can allow unauthenticated remote code execution. PHP assesses Apache mod_php as the highest-risk deployment.
Which PHP Versions Include The October Fixes?
| PHP branch | Fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Distribution and hosting vendors may backport fixes under different package versions. Check their evidence rather than relying on a version string alone.
What Changed In The 23 October Follow-Up?
PHP’s later notice concerns session upload progress with an unusual runtime change of session serializer. It recommends disabling that feature until the next regular bugfix release, with an exception for applications that never change the serializer at runtime. Have the maintainer assess the exact conditions in the official notice.
What Should A Business Owner Ask Their IT Maintainer?
- Who owns the maintenance decision for each website and application?
- What vendor evidence documents the relevant fixes, including bundled or containerised runtimes?
- What recovery arrangements and application checks support the maintenance window?
- Who will investigate suspicious activity and communicate the outcome?
Keep system addresses, logs and account details within authorised support channels. If compromise is suspected, agree an investigation; do not treat installing a patch as proof that earlier activity was harmless.
Common Questions
Does Updating WordPress Plugins Fix PHP Itself?
No. PHP is the runtime beneath the application. Application updates and runtime maintenance need separate confirmation from the responsible maintainer.
Can A Business Outsource The Technical Assessment?
Yes. Agree the systems covered, evidence required and responsibilities with the provider. T Strategy’s Cyber Security services and IT Managed Services provide starting points for discussing an appropriate scope.
For a practical next step, discuss your website security requirements with T Strategy.
Stay informed
Get Important IT Updates In Your Inbox
Receive relevant security alerts and a monthly practical digest from T Strategy, with service offers where useful. Choose the topics that matter to your business.
Need Help With An IT Issue Now?
Request assistance separately so our team can discuss your requirements.
Request a service discussion →