What Does the October PHP Update Mean for Your Website?

Understand the October 21 PHP fixes, what to ask your hosting provider and which customer tasks to check after the update.

Illustration of FAMtastic Fritz beside a laptop, with the headline “PHP security update: What should you check?”
FAMtastic Designs — What should you check after the PHP security update?

Updated October 21, 2026.

If your website uses PHP, ask your hosting provider or developer to confirm that the October 21 security fixes are applied to the system serving your site. PHP is software that runs website functions on a server. Your homepage can look normal while that software still needs attention.

The PHP project released fixes for two critical flaws that can allow someone to run code remotely without signing in. It urges users to update immediately. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some providers deliver fixes through their own maintained packages, so ask for patch confirmation as well as a version number. PHP's official security notice

You do not need to become a programmer. You need a clear answer from the person responsible for your hosting, followed by a check of the work your customers do on the site.

What happened with the government websites?

In a notice published October 21 at 15:13 Netherlands local time, the Dutch government reported that several government websites had been taken offline as a precaution. That was a preventive response; it does not establish that every offline service had been attacked. The notice describes that point in time, not the current availability of each service. Dutch government announcement

For your business, the useful question is specific: who maintains the software behind your website, and what have they confirmed? A news story cannot answer that for your individual site.

Send your provider this question

Please confirm whether our website uses PHP and whether the October 21 fixes for CVE-2026-109618 and CVE-2026-109619 are applied to the environment serving our website. If you use a vendor backport, please identify the patched package. Who will check our important customer functions after the update?

Those CVE numbers identify the two flaws. A backport is a fix a vendor applies to a package it continues to maintain, without necessarily adopting the newest upstream version number. PHP's notice explains why that provider context matters. The two official advisories identify the flaws and patched releases. CVE-2026-109618 advisory · CVE-2026-109619 advisory

Ask for a written response you can keep. It should identify the site, the relevant package or update, when it was applied, and anything still outstanding. If the company hosting the site and the person maintaining its application are different, include both.

Make sure you are discussing the right update

Your content management system is the application used to manage pages and content. PHP runs underneath it. Updating a plugin or changing a page does not, by itself, show that PHP has been patched.

“We updated WordPress” and “we confirmed the PHP fixes on the server handling your requests” describe different work. Ask which layer was checked and what supports the answer.

If an update causes a compatibility problem, ask what specifically failed and what repair is needed. Before changing versions, have the responsible technical person confirm the update approach, dependencies and recoverable backup. Avoid choosing a version at random in a hosting panel.

Check what customers need to finish

Once the provider applies the fix, agree on a short list of customer tasks to verify. Start with the ones that matter to your business:

A button showing success is only one observation. Check the saved result and the staff handoff too. For payments, appointments or notifications, agree on a controlled test method so you do not create unwanted charges or messages.

Record what passed, what failed and who owns the remaining work. These checks establish whether the selected functions work after the change. They are separate from patch evidence or an investigation into a suspected intrusion.

Do you need to replace the website?

An urgent software update does not automatically require a new website. A maintained site may need the update and verification. An older integration may need a focused compatibility repair. A larger migration or rebuild deserves its own explanation.

Ask: What is incompatible? What can stay? What would have to move? How will we know the work is complete? Compare those answers before committing to a redesign.

For a practical comparison, read Should You Repair Your Website or Rebuild It?.

Need help fixing your website?

FAMtastic Designs can help assess the issue, carry out agreed repairs and check the customer experience. Start with a free initial website review: share your public site address, the problem you have noticed and your hosting provider if known.

We will help identify the next step and scope any repair, compatibility work or rebuild separately. The initial review is a starting conversation, not implementation or a security certification. Please keep passwords and private customer information out of your first message.

Message FAMtastic Designs on Instagram for a free initial review.

Common questions

My site is working. Does that prove it is patched?

No. Ask the responsible provider for patch evidence; the appearance of a page does not answer that question.

Can I just update my website plugins?

Ask your provider to distinguish application updates from the PHP runtime fixes and confirm the relevant work at each layer.

Do you need my password for the free initial review?

No password is needed for the initial conversation. Any later access or work should follow an agreed scope and appropriate access method.