By Daniel K. Nanghaka · Security information checked on 23 October 2026.
On 21 October 2026, PHP released emergency security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both can allow attackers to execute code without logging in. Website owners should confirm that the PHP runtime serving their sites has received the fixes.
For businesses, developers and institutions relying on PHP-powered applications, this is a reminder that digital transformation requires continuous investment in maintenance, security and resilience.
1. Understanding the security vulnerabilities
The PHP project identifies two memory-safety problems: out-of-memory corruption (CVE-2026-109618) and stale global state (CVE-2026-109619). Its advisory covers PHP installations serving web requests and highlights Apache mod_php as particularly exposed. See the official PHP security advisory.
Remote code execution can put website content, application data and service availability at risk. Potential consequences include malicious redirects, unauthorised file changes and access to information available to the compromised process. These are possible consequences, not a claim that every affected website has been compromised.
2. Which PHP releases contain the fixes?
| PHP branch | Fixed release | Action |
|---|---|---|
| 8.5 | 8.5.12 | Install the fixed release or a newer security release. |
| 8.4 | 8.4.27 | Install the fixed release or a newer security release. |
| 8.3 | 8.3.36 | Install the fixed release or a newer security release. |
| 8.2 | 8.2.35 | Patch now and plan an upgrade. |
| 8.1 and older | Vendor-specific backports | Obtain explicit vendor confirmation and plan migration. |
Older branches are outside normal upstream support. Backported packages may retain an older-looking version number; ask the vendor to confirm coverage of both CVEs. A version number alone may therefore be insufficient evidence.
3. Temporary protection is not a complete fix
PHP states that configuration workarounds cover only specific attack paths. Updating is the complete solution. Administrators should follow the official advisory rather than copy isolated settings without assessing their operational effects.
InMotion Hosting reports that it disabled upload-progress tracking and, on PHP 8.5, fatal-error backtraces as precautions. Its notice says custom session-based upload progress bars may stop reporting progress while uploads still complete. These precautions do not establish that an installation is fully patched.
4. What website owners should do now
Check the PHP runtime your website actually uses
In cPanel, inspect MultiPHP Manager or PHP Selector and identify the runtime assigned to each domain. In WordPress, review Tools → Site Health → Info → Server. Ask your host for the installed package build and confirmation that both vulnerabilities are addressed.
Developers can run php -v to inspect command-line PHP, but that may differ from the version handling web requests. Check every relevant PHP-FPM pool, website and application runtime.
Back up and test compatibility
Create a restorable backup covering website files, databases and relevant configuration. Before changing PHP branches, test the application, plugins, themes and dependencies in a staging environment where available. Prioritise security patching while keeping the compatibility checks focused.
Apply the update and restart affected services
For managed hosting, request confirmation that patching is complete for your specific server. For self-managed infrastructure, install your vendor’s security packages and restart the relevant PHP workers and web-server services as required. Verify the running web runtime after the restart.
Check critical website functions
Test login, forms, uploads, checkout and other business-critical workflows. Review error logs for new failures. Updating WordPress core, themes or plugins remains useful maintenance, but does not itself replace a server-level PHP update.
Review signs of compromise
Unexpected administrator accounts, altered files or unfamiliar redirects warrant investigation. Preserve relevant logs and involve your hosting provider or incident-response support if you suspect a breach. Installing a patch does not undo an earlier compromise.
5. Hosting responsibilities differ by plan
The original notification came from InMotion Hosting. Its security update reports patched Shared, Reseller and WordPress Hosting environments, while other server rollouts depend on the platform and vendor. This is provider-specific information, not a guarantee for all hosting services.
- Shared and managed WordPress hosting: confirm the provider has completed patching for your account.
- Managed VPS and dedicated servers: ask whether your server, all installed PHP branches and running workers are covered.
- Self-managed servers: you or your administrator must install and verify the updates.
- Legacy or CWP environments: verify package availability directly; do not assume another control panel’s backports apply.
Deployment information changes. Consult the provider’s current status and support team rather than relying on a dated snapshot.
6. Legacy applications need a migration plan
Many organisations depend on older applications for registration, finance, inventory and institutional records. Replacing them can be difficult, but leaving the runtime unsupported creates a growing maintenance burden.
Commercial extended support may provide a temporary migration window. Confirm the exact operating system, PHP package and CVE coverage before relying on it. Establish a practical upgrade plan covering application compatibility, testing, cost and business continuity.
7. What this means for African businesses and digital platforms
Africa’s businesses, startups, government institutions and development organisations increasingly rely on web systems to deliver services. Affordable deployment must be matched by a realistic maintenance budget.
- Infrastructure visibility: maintain an inventory of applications, servers, runtimes and responsible vendors.
- Security ownership: assign a named person or team to production updates.
- Vendor accountability: request clear patching evidence and customer responsibilities.
- Legacy modernisation: budget for upgrades before technologies become unsupported.
- Business continuity: test backups, restoration and incident-response arrangements.
These practices matter especially where platforms hold personal, agricultural, financial or institutional information. Security is part of the service an organisation delivers to its users.
8. A shared operational responsibility
Developers should build applications that can be maintained and upgraded. Hosting providers should operate reliable patch-management processes. Business leaders should fund maintenance and establish accountability.
The immediate task is concrete: verify the PHP build serving each website, apply the appropriate security update, restart affected processes and confirm normal operation. The longer-term task is to make that process routine.
About the author
Daniel K. Nanghaka is a technology professional, software developer, digital transformation specialist, and Founder & CEO of IgniPoint LLC. His work spans digital infrastructure, software engineering, cybersecurity, internet governance and digital platforms supporting businesses and institutions across Africa.
Sources and verification
- PHP project: security advisory and fixed releases, 21 October 2026
- CERT-EU: Critical Vulnerabilities in PHP
- InMotion Hosting: critical PHP security release and provider response
This article updates the earlier draft with verified release information. Hosting deployment status is time-sensitive; confirm the current position for your own server.