PHP Vulnerabilities: Patch Guidance for Website Agencies

Free Instant SEO Audit

A bank vault door cracking open to reveal PHP vulnerabilities

By NewSunSEO October 22, 2026

Updated October 22, 2026 at 7:14 AM ET

Website owners can protect client systems by checking their PHP patch status now, confirming how PHP is exposed, and reviewing host or vendor updates for two critical request-handling vulnerabilities. Red Hat reports that an unauthenticated remote attacker may be able to trigger memory corruption, with potential for arbitrary code execution, while fixes are being released in phases.

What happened

OpenAI reports that it coordinated with maintainers, researchers, and security providers to address two critical vulnerabilities in PHP over a two-month period. Red Hat’s security bulletin says fixes for CVE-2026-109618 and CVE-2026-109619 are available in part, with additional updates still in progress.

Are you affected?

The flaws affect PHP request processing and have been assigned CVE-2026-109618 and CVE-2026-109619. Red Hat lists Red Hat Enterprise Linux 8, 9, and 10, Red Hat OpenShift Dev Spaces 3, supported products based on Red Hat Enterprise Linux, and RHEL CoreOS or container images based on affected Red Hat operating-system images as directly or potentially affected.

Systems without PHP, or systems that do not expose PHP to untrusted HTTP requests, are not affected, according to Red Hat. Standard Red Hat Enterprise Linux deployments generally use PHP-FPM rather than mod_php, and PHP-FPM workers normally exit on early initialization failures before reaching the corrupted structures. Environments using mod_php with the default configuration face higher risk.

For a managed website, the agency should inspect the host or platform’s PHP version, package update state, and runtime configuration. Red Hat says customers should ensure the underlying RHEL PHP package is current and should rebuild customer containers after base images are updated. The PHP maintainers’ advisory and host provider’s release notes remain the authoritative sources for the applicable PHP version.

What to do now

Ask the hosting provider or platform administrator whether the PHP package has been updated for CVE-2026-109618 and CVE-2026-109619.
Review the official PHP upgrade instructions for the deployed release, then apply the vendor or host’s fixed package when it is available.
Confirm whether the site uses PHP-FPM or mod_php. Red Hat identifies environments running mod_php with its default configuration as higher risk.
Check whether PHP is exposed to untrusted HTTP requests. Do not expose an affected PHP runtime without confirming its patch status and relevant mitigations.
Rebuild customer containers after the underlying Red Hat base image has been updated, then verify the running image and package version.

What we’re seeing

NewSunSEO’s managed hosting fleet included 58 WordPress sites read on October 21, 2026. Of those, 57 ran PHP 8.3.36, one site’s PHP version was not readable, and all 58 ran WordPress 7.1.3. This fleet data does not show whether any site is affected by the two PHP vulnerabilities, so the host-level package check remains necessary.

Why agencies need a coordinated check

The PHP response shows why a managed website agency has to check more than the front-end application version. The vulnerability sits in request processing, and the correct response depends on the operating system package, PHP runtime, web server arrangement, container base image, and exposure to outside requests.

Red Hat says its investigation and mitigation work is ongoing, with detailed mitigation guidance to follow in a future bulletin. Its initial advice is to prioritize updates based on the exposure of the asset, known exploitation status, exploit automation, and the technical impact after exploitation. The company’s bulletin specifically says some updates are already available, while others remain in progress, so an agency should document the exact package and image version it has deployed before deciding whether an additional mitigation is needed.

CISA’s Binding Operational Directive 26-04 provides a related risk-based approach for federal agencies. It directs agencies to prioritize vulnerabilities according to public exposure, Known Exploited Vulnerabilities status, whether exploitation can be automated, and whether an attacker gains partial or total control. The directive does not replace the PHP maintainer’s patch instructions, but it gives agencies a framework for deciding how quickly each system should be addressed.

Keep the evidence in the client record

For agencies that maintain client websites, the useful record includes the PHP version, operating-system or container package version, web server mode, date of the last update, and the person who verified the deployed release. This lets the agency distinguish a site that is waiting for a host package from one that has a current package but still needs a runtime configuration review.

OpenAI also says that interim protections can reduce risk, but their limits and operational tradeoffs should be clear. Temporary measures should therefore be recorded as temporary measures, alongside the permanent update path.

FAQ

Which PHP vulnerabilities require urgent attention?

Red Hat identifies CVE-2026-109618 and CVE-2026-109619 as memory corruption flaws in PHP request handling. It says an unauthenticated remote attacker can trigger memory corruption, potentially achieving arbitrary code execution.

Which environments are most at risk?

Red Hat says systems without PHP, or systems that do not expose PHP to untrusted HTTP requests, are not affected. Environments running mod_php with the default configuration are at higher risk than standard Red Hat Enterprise Linux deployments using PHP-FPM.

What should a website agency do first?

First check the PHP package and operating-system or container version through the hosting provider or administrator. Then review the PHP maintainer’s official upgrade instructions, apply available fixes, verify whether PHP-FPM or mod_php is in use, and rebuild containers when their base image has been updated.

This article reports on publicly available information from the sources listed below. We have no reason to believe it is inaccurate, but we have not independently verified every claim, and details may change as the story develops.