PHP Security Vulnerability: Why Website Maintenance Matters
PHP is the technology behind many websites and content management systems, including WordPress. On October 21, 2026, the PHP team released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The flaws could allow an unauthenticated attacker to run code on an affected server. 2026
The vulnerabilities have been referred to as “PHP2Shell.” The PHP team rated them critical and urged users to update. The fixed releases for supported PHP branches include PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The correct update for a website depends on the PHP version and how its hosting provider distributes updates. 2026
What is PHP, and why does it matter?
PHP runs behind the scenes to help websites process requests and display pages. WordPress, for example, depends on PHP to operate. When a vulnerability affects PHP, the issue may involve the website’s server environment—not just the visible website or its WordPress dashboard.
That’s why website security takes more than updating a page or installing a plugin. The underlying PHP version, WordPress core, themes, plugins, hosting configuration, and backups all need attention.
Why ongoing website maintenance matters
Security issues can emerge at any time. A site that was up to date when it launched may become exposed later as new vulnerabilities are discovered and software updates are released.
Ongoing maintenance helps ensure someone is regularly checking for updates, applying security fixes, and confirming that the website continues to work afterward. Updates can affect compatibility, so they should be handled with care, especially on sites that rely on custom features or many plugins.
A maintenance plan can include:
- Applying PHP, WordPress, theme, and plugin updates
- Checking that updates don’t disrupt important website features
- Monitoring the site for security and performance issues
- Maintaining backups that can help restore the site if something goes wrong
- Reviewing the site’s software and hosting environment over time
What website owners should do
If you manage your own website, contact your hosting provider or web developer to confirm that the PHP environment serving your website has received the appropriate security update. Don’t rely only on the PHP version shown in a control panel or command-line tool; the version serving the live site may be different. Datadog Security Labs
Also keep WordPress core, themes, and plugins updated. PHP updates address vulnerabilities in the PHP runtime; they don’t replace the need to maintain the rest of your website.
Planned Growth customers are covered
Planned Growth has applied the latest PHP security patch to websites we maintain, addressing this latest threat. If your website is already maintained by Planned Growth, this PHP update has been taken care of.
If your website isn’t currently maintained by Planned Growth, we can review its PHP environment and website software to help determine whether it has received the appropriate updates. We can also discuss ongoing website maintenance to help keep your site current as future updates become available.
Want us to check your website? Contact us to ask about a security review or ongoing website maintenance.
This article provides general information and is not a guarantee that a website is free from security risks. Website security depends on the full hosting and software environment.
Sources: PHP 2026 security release · Datadog Security Labs analysis