Two serious holes were found in PHP. Is your site patched?
On October 21, 2026, the PHP team released emergency fixes for two critical security holes — known as CVE-2026-109618 and CVE-2026-109619. The holes are in PHP itself — the engine that runs WordPress and most other websites — not in WordPress, a plugin, or anything you installed. An attacker needs no password and no login to use them, and a successful attack can hand over control of a site.
The good news: the fix is simply a newer PHP version. Type your site's PHP version below and this page will tell you, in plain English, whether you're covered — and exactly what to say to your hosting company if you're not.
Check your version
The patched versions, at a glance
| If your site runs… | You're patched at… | |
|---|---|---|
| PHP 8.5 | 8.5.12 | or higher |
| PHP 8.4 | 8.4.27 | or higher |
| PHP 8.3 | 8.3.36 | or higher |
| PHP 8.2 | 8.2.35 | or higher — but note 8.2 reaches end of life on Dec 31, 2026, so 8.3 or 8.4 is the better long-term home |
| PHP 8.1 or older | — | No patched release exists. PHP no longer fixes these branches; the fix is moving up to 8.2 or higher. |
One caution that applies everywhere below: some hosting companies quietly slip the fix into an older version number (called a “backport”), so the number alone can look unpatched when the fix is actually in. Only your host can confirm that — which is why the messages below ask them directly.
Don't know your PHP version? Here's how to find it
If your site runs WordPress (most do):
- Log in to your WordPress dashboard.
- In the left menu, go to Tools → Site Health.
- At the top of that screen, click the Info tab.
- Open the Server section.
- Find the line labelled PHP version — it will look like 8.2.29 (Supports 64bit values). That's your number; bring it back here.
Other ways to find it:
- Your hosting control panel — most hosts list the PHP version in a “PHP settings” or “PHP selector” area. Be aware some panels show only the branch (like “8.4”), not the full number — the full three-part number is the one that matters here, and the WordPress route above always shows it.
- Ask your host — support chat can tell you the exact version in one message. Ask for all three numbers, e.g. “8.4.27”, not just “8.4”.
What this page can and can't tell you
- It can't see into your server. This page judges only the version number you type in, against the patched releases PHP published. It never connects to your site.
- A version below the line isn't proof you're exposed. Some hosts backport the fix into older version numbers. If your host says you're covered, ask them to confirm the build includes fixes for CVE-2026-109618 and CVE-2026-109619 — the message generator above does exactly that.
- A firewall is not a patch. Services like Cloudflare can block known attack shapes and buy you time, and that's genuinely useful — but they can't recognise every attack, and they don't repair the hole. Updating PHP is the only complete fix.
- Updating a plugin or WordPress itself won't fix this. The hole is underneath WordPress, in PHP. Only a PHP update — which your hosting company controls — closes it.