Server security
PHP Emergency Patch: Why Server Updates and Monitoring Matter This Week
By Avery Parker, Diversified Tech Solutions ·
If your website runs on PHP, this week's news is worth five minutes of your time. No panic needed. Just a plan.
What happened
On Tuesday, October 20, the PHP security team told administrators to get ready for emergency security updates. The fixes are scheduled for Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern). They address two critical vulnerabilities, each rated 9.2 under CVSS v4.0.
According to BleepingComputer, information about the flaws reportedly leaked before the planned disclosure. Researchers at watchTowr told BleepingComputer the two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution flaws believed to affect PHP versions 5, 6, 7 and 8. watchTowr rates both a CVSS 10.0. The PHP team also said it may release earlier if details go public or if exploitation shows up in the wild.
The good news: watchTowr said it hasn't seen these flaws exploited in the wild. The PHP team hasn't published technical details or a list of affected versions yet. It says those will come with the updates.
Who's affected
PHP sits under a huge slice of the web. If your site runs on any of these, PHP is doing the work behind the scenes:
- WordPress
- Drupal
- Joomla
- Magento
- Custom PHP apps, client portals and older in-house tools
Until the PHP team publishes the affected versions, the safe assumption is that if you run PHP, this one is on your list.
Why server updates matter
Most people think about website updates as plugins and themes. Those matter. But underneath your site is the server: the operating system, the web server and PHP itself. When PHP ships a fix, someone has to actually install it on the server where your site lives. A patch that's been released but not applied doesn't protect anybody.
Here's the part that catches people. PHP only fixes branches it still supports. Right now, per php.net, that's PHP 8.2, 8.3, 8.4 and 8.5. Anything older, like 7.4, 8.0 or 8.1, is end of life. Those versions won't get this fix. And PHP 8.2 only has security support through December 31, 2026, so it's on the clock too.
I've been fixing hacked sites and running servers since the early 1990s, and the pattern hasn't changed much. The sites that turn into cleanup jobs usually aren't the ones that got hit by something brand new. They're the ones that were running something old that nobody was watching.
Why monitoring matters
Patching closes the door. Monitoring tells you if someone's been trying the handle.
Once details on a flaw like this go public, people start scanning for servers that haven't been patched. That's normal and it's predictable. Active monitoring on your web servers is how you catch it: unusual requests in the logs, unexpected processes, new files showing up where they shouldn't, or a sudden spike in errors. If something is being attempted or exploited, you want to know today, not when a customer calls about a strange redirect.
Updates and monitoring work as a pair. One without the other leaves a gap.
What to do this week
- Check your PHP version. Your hosting control panel usually shows it. In WordPress, go to Tools, then Site Health, then Info, then Server.
- Patch when the release lands. The updates are scheduled for Wednesday, October 21, at 10:00 AM Eastern. Plan to apply them as soon as you can after that, after a backup.
- Confirm your host is patching. If you're on shared or managed hosting, ask your host directly whether and when they're applying the PHP update. Get the answer in writing if you can.
- Plan your way off end-of-life PHP. If you're on anything older than 8.2, this release won't help you. Moving up a version can break old plugins or custom code, so test it on staging first. Don't flip it on a live store and hope.
- Watch your logs and monitoring. Keep an eye out for unusual activity over the next few weeks, especially once technical details are public.
If the fix isn't out yet when you read this, there are still steps you can take to reduce your exposure. I wrote those up in a companion post on hardening before the patch exists.
How DTS can help
This is the kind of work our server maintenance and care plans are built for: applying updates on a schedule you can point to, watching the servers, and having a plan for the day an emergency patch drops. Our WordPress Care Plans are published at $149, $249 and $399 a month, and every tier includes updates, daily backups and uptime monitoring. If you'd rather have someone own this for you, take a look at our WordPress maintenance page or give us a call.
And if you think your site has already been compromised, start with our WordPress incident response hub. Please don't wipe anything yet.
FAQ
Is my WordPress site affected by the PHP flaws?
If your site runs on PHP, which every WordPress site does, it's worth treating this as relevant. The PHP team hasn't published the exact affected versions yet, but researchers at watchTowr believe PHP 5 through 8 are affected. Check your PHP version and plan to patch once the updates are out.
Are these PHP vulnerabilities being exploited right now?
As of October 20, watchTowr said it hadn't seen exploitation in the wild. That can change once technical details are public, which is why patching and monitoring both matter.
What if my site runs an older PHP version like 7.4 or 8.1?
Those versions are end of life, so they won't get this fix. You'll want to plan an upgrade to a supported branch (8.2 or newer, per php.net), ideally tested on staging first. Until then, extra hardening and monitoring help reduce risk.