PHP security update, 21 October 2026

WordPress PHP update service

We coordinate the PHP security update with your host, check your backups and test your website afterward.

Get help with my PHP update Ask your host first

From $199 per WordPress site We reply within 24 hours. Scope, price and timeline confirmed first

Price and scope

From $199 per WordPress site on managed or shared hosting

Included

Confirm the active PHP version and patch status with your host.
Check that a current backup and a rollback route exist.
Coordinate the patch, or a move to a supported PHP branch, with your host.
Test key pages, login, forms and checkout afterward.
A short written summary of what changed.

Quoted separately

Compatibility repairs, under the Website Fix Sprint ($555).
Upgrades from PHP 8.1 or older that need code changes.
Server administration on a VPS or dedicated server.
Migrations to another host or platform.
Suspected compromise or malware cleanup.

Compatibility repairs follow the Website Fix Sprint: one website, one agreed priority, $555.

One-time

From $199

WordPress PHP Update for one WordPress site on managed or shared hosting.

Get help with my PHP update

We confirm the scope, price and timeline before starting.

Timing

How quickly we help

We reply within 24 hours. For straightforward updates, we aim to complete the work within a few days once the scope and access are agreed.

Ask your host to patch now. Our timeline should not delay that request.

Ask your host first

A message to send your hosting provider

Your host controls the PHP runtime on managed and shared hosting. Copy this message into a support request, replace “my website” with your address, and ask for a written answer.

Hello,

Please confirm whether the PHP runtime serving my website includes the fixes for CVE-2026-109618 and CVE-2026-109619, which PHP released on 21 October 2026.

1. Which exact PHP version or vendor package revision is active for this site?
2. If you rely on backported fixes, please share the vendor advisory.
3. Does the update cover every web worker and server for this site, and has the required restart been completed?
4. If patching is still pending, what is the plan, and which exposure controls are in place until then?

Please also review these separate PHP notices. Public PHP version clues cannot determine whether either applies:
5. For PHP's 23 October 2026 session upload progress notice (CVE-2026-115560), is session.serialize_handler configured as php_binary or php_serialize and switched to php with ini_set() before session_start(), while upload progress remains enabled? Please confirm whether session.upload_progress.enabled=0 is needed until the next regular bugfix release, and keep it in place if already applied. PHP had not named a fixed release when checked on 28 October 2026.
6. If this site runs PHP on Windows, please confirm the installed package includes Brotli 1.2.1 for CVE-2026-111497 (the 26 October 2026 -1 package rebuild or a vendor-confirmed dependency update), and whether cURL automatic HTTP response decompression is enabled. This package rebuild does not change the PHP runtime version.

Thank you.

What happened

The 21 October 2026 PHP security release

On 21 October 2026, PHP released critical fixes for CVE-2026-109618 (opens in a new tab) and CVE-2026-109619 (opens in a new tab). These are the first fixed upstream releases; later releases include the fixes too.

First fixed upstream PHP releases for CVE-2026-109618 and CVE-2026-109619
PHP branch	First fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 or older	No new release

PHP 8.1 and older no longer receive updates from the PHP project. For people who build PHP from source, the PHP security team published minimal source patches for PHP 7.4 source patch (opens in a new tab), PHP 8.0 source patch (opens in a new tab) and PHP 8.1 source patch (opens in a new tab). Some distributions and long-term support vendors provide backported fixes. Ask your vendor, and plan a move to a supported branch.

A distribution or host may also backport the fixes into a package with an older-looking version number, so ask your host to confirm that the installed package fixes both vulnerabilities.

Later notices need separate checks

The first fixed releases above address the two 21 October vulnerabilities. They do not settle the later configuration or Windows dependency notices. Both need evidence from your host or developer.

Configuration notice, 23 October 2026 · Applicability unknown

Session upload progress configuration notice

The unusual setup requires session.serialize_handler to be configured as php_binary or php_serialize, switched to php with ini_set() before session_start(), and session upload progress to remain enabled. PHP recommends session.upload_progress.enabled=0 until the next regular bugfix release. Keep that setting if already applied. Applications that never change the serialize handler at runtime can keep upload progress enabled. PHP plans the full CVE-2026-115560 advisory with the next release; no fixed release was named when checked on 28 October 2026. Public PHP version clues cannot establish whether this notice applies to the site.

Read PHP's official notice

Windows package rebuild, 26 October 2026 · Applicability unknown

Windows package rebuilds for Brotli

The rebuilt Windows packages are 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. In PHP Windows builds, the Brotli decoder can be reached through cURL when automatic HTTP response decompression is enabled. cURL disables it by default, but applications and HTTP client libraries can enable it. The -1 suffix identifies Windows packages rebuilt with Brotli 1.2.1 for CVE-2026-111497. The PHP source releases and runtime versions stay unchanged. Ask the host to confirm the installed Windows package or vendor dependency update. Public PHP version clues cannot establish whether this notice applies to the site.

Read PHP's official notice

Our PHP Version Checker reads public version clues. It cannot confirm the installed fixes or whether the later notices apply. Ask your host or server administrator for runtime, configuration and package evidence.

Why ask us

WordPress and PHP guidance others link to

Elementor's official system requirements (opens in a new tab) link to our Elementor PHP guide in their PHP recommendation.

Our WordPress and PHP guides

★★★★★

“Absolutely amazed at the service provided, not only have they designed my original business website 7yrs ago and have provided me with maintenance over the years but recently got an upgraded website over haul and new design. Couldn’t speak any more highly.”

Wellington House Repiling Ltd, construction, New Zealand · Trustpilot review

After the update

Ongoing care for future security updates

Our WordPress care plans start at $49/month and keep core, theme and plugin updates, backups and monitoring on a routine, so the next security update has an owner.

See WordPress care plans

WordPress PHP update

Questions about the PHP update

Does a first fixed PHP release resolve the later October notices?

No. The first fixed releases listed here address CVE-2026-109618 and CVE-2026-109619. PHP's 23 October session upload progress notice needs a configuration and application-code check, and its 26 October Windows rebuild updates Brotli without changing the PHP runtime version. Public PHP version clues cannot establish whether either later notice applies. Ask your host and developer to review them.

Will updating WordPress or Elementor fix the PHP vulnerabilities?

No. WordPress and Elementor updates do not replace the PHP runtime on your server. Your hosting provider or server administrator must install the PHP security update for CVE-2026-109618 and CVE-2026-109619 and activate it for your site. Keep WordPress and plugin updates current as well.

What does the $199 PHP update include?

For one WordPress site on managed or shared hosting, we confirm the active PHP version and patch status with your host, check that a current backup and a rollback route exist, coordinate the patch or a move to a supported PHP branch with your host, test key pages, login, forms and checkout afterward, and send a short written summary of what changed.

What is quoted separately?

Compatibility repairs go under the Website Fix Sprint ($555). Upgrades from PHP 8.1 or older that need code changes, server administration on a VPS or dedicated server, migrations, and suspected compromise or malware cleanup are quoted separately. We confirm the scope, price and timeline before starting.

How fast can you help?

We reply within 24 hours. For straightforward updates, we aim to complete the work within a few days once the scope and access are agreed. Ask your host to patch now. Our timeline should not delay that request.

What if my host cannot patch yet?

Ask the host for a concrete patching timetable and for the exposure controls they will use until the fix is installed. A firewall rule, a hidden version header or a WordPress plugin does not confirm that the PHP runtime has been fixed.

What if the PHP update breaks something?

Involve the host straight away. Rolling back to a vulnerable PHP build reopens the risk, so agree on a patched alternative while the problem is fixed. Compatibility repairs are scoped as a Website Fix Sprint ($555) for one website and one agreed priority.

Do you work with agencies?

Yes, through our referral programme. Refer your client and earn 10% of the project fee. We work with your client directly, and we never do white-label work.

Agencies and developers: refer your client and earn 10% of the project fee. Referral terms apply.

A clear next step

Get your PHP update coordinated and tested

Send your website and, if you know it, your hosting provider. We confirm the scope, price and timeline before starting.

Get help with my PHP update Ask your host first

We reply within 24 hours.