PHP security update: what happened and what it means for our clients
All client websites managed by WE MANAGE have received the latest applicable PHP security fixes. Following the disclosure of two critical PHP vulnerabilities, the updates are complete.
For business owners, the important question is straightforward: what happened, and has the software behind my website been updated? Here is what you need to know.
What is PHP?
PHP is a programming language that runs on a website’s server. It helps process forms, sign-ins, and database information to generate the pages and features visitors use.
What happened?
On 21 October 2026, the PHP project released security updates addressing two critical vulnerabilities. Under certain conditions, these flaws could allow someone to run code on an affected server without logging in.
PHP works behind the scenes on many websites. A problem at that level concerns the software running the website, even when its pages still look and behave normally.
What were the two vulnerabilities?
Both issues involve how PHP handles memory during a request or after an error.
- CVE-2026-109618: an out-of-memory condition could leave internal data partly initialized. PHP could later treat that incomplete data as valid, causing memory corruption.
- CVE-2026-109619: internal state could retain a reference to memory that had already been freed. A later request could reuse that invalid reference.
These are technical faults inside PHP itself. Researchers demonstrated that they could lead to remote code execution in affected configurations. A vulnerability alone does not establish that a website has been breached.
Technical sources: first vulnerability and second vulnerability.
What this means for WE MANAGE clients
We have applied the latest applicable PHP security fixes across all client websites we manage.
Our clients should be able to focus on their services, customers, and daily work. Keeping the underlying website software current is part of the ongoing attention a business website needs after launch.
If you have a question about a particular website or hosting environment, contact our team. We can discuss the update relevant to your service and explain it in plain language.
Which PHP releases include the fixes?
The releases issued on 21 October were PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Hosting providers and operating-system vendors may also distribute patched packages through their own update channels.
The appropriate update depends on the PHP branch and hosting environment. Your provider should confirm that the running installation includes fixes for both vulnerabilities.
Why ongoing website care matters
A website continues to need attention after its design is finished. The pages customers see depend on software, hosting, and services that change over time.
For a business in Erbil, Kurdistan, or elsewhere in Iraq, it helps to have a clear point of responsibility: someone who can explain what needs updating and answer questions when an important security announcement appears.
That clarity matters just as much as a professional homepage. It gives business owners a direct route from a worrying headline to an understandable answer about their own website.
Have a question about your website?
Contact WE MANAGE to discuss your website and its ongoing management.
Discuss your website with WE MANAGE
Advice for website visitors
If a website is known to have unpatched security vulnerabilities, avoid using it until its operator confirms the fixes are in place. In particular, do not sign in or enter passwords, verification codes, payment details, or other sensitive personal information. A website’s age or appearance alone does not tell you whether it is secure, and HTTPS does not prove its server software is up to date. If you are unsure about its security, check with the operator before sharing sensitive information.