Critical PHP Security Update: What Website Owners Need to Know

If your business has a website, you may be hearing about a serious PHP security issue this week. PHP is the software behind many websites, including WordPress sites. On October 21, the PHP project released fixes for two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. An attacker who can exploit an unpatched, internet-facing PHP installation could potentially run code on its server without logging in.

This is a reason to act promptly, but it is also a problem with a practical path forward. The first step is to check the actual PHP package running each website and confirm that its security fix has been installed.

Which websites are affected?

The issue concerns PHP installations serving web requests across common server configurations. A site is not automatically compromised because it uses PHP; the concern is whether its running PHP build is vulnerable. Updating a WordPress theme or plugin alone does not install a PHP server patch. The hosting environment needs attention too.

The PHP project has released patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It is not releasing ordinary PHP project updates for 8.1 and earlier because those branches have reached the end of their support. Websites on older PHP therefore need their host to provide a verified backported fix or a plan to move to a patched, supported version.

What about CloudLinux and PHP 7.4?

Muskoka Graphics owns servers that use PHP, and we use CloudLinux in our hosting environment. CloudLinux reports that fixed packages for its supported PHP builds, including older alt-php and ea-php branches, are available in its stable repositories. That includes a patched CloudLinux build for PHP 7.4. Its fixes are backported: CloudLinux applies the security repair to an existing branch, so its displayed PHP version may still say 7.4.33 or show an older 8.x number.

That distinction matters. PHP 7.4 is not safe simply because it is 7.4, and moving a site from PHP 7.3 to an unpatched 7.4 would not solve the problem. The specific installed CloudLinux package must be updated, the PHP services restarted, and the fix verified against CloudLinux’s package information. Likewise, a version-only security scan can misidentify a properly backported build. CloudLinux also notes that its very old alt-php44and alt-php51 branches have no fixed build.

A backport provides a way to address these particular vulnerabilities on compatible older sites. It is not a substitute for maintaining the website or eventually moving to a current, supported PHP branch.

Why an older website may need more work

Changing a PHP version is sometimes a simple hosting setting. For an older website, it can reveal code, plugins, themes or integrations that no longer work with current PHP. A booking form, payment step or customer login is just as important to test as the home page. Switching versions without checking those functions could interrupt the business.

That is why there are two related jobs: secure the server now with an appropriate verified package update, and plan the site’s upgrade when its code cannot yet run on a modern PHP branch. The work required will vary by site. It may involve updating the content management system and extensions, replacing an abandoned plugin, repairing custom code, or rebuilding an application that is too old to maintain safely.

What Muskoka Graphics is doing for clients

We are reviewing the PHP versions and package status in our hosting environment against the CloudLinux advisory. Website owners whose sites may be unable to move directly to a current PHP version because of the age of the website will receive a separate email about their situation. That message is intended to help you understand the next steps for your own site; this general article is not a declaration that every individual site has been checked or patched.

If your website needs attention, Muskoka Graphics can assess its PHP and application compatibility, recommend what can be updated, provide a scope for the work, and test the site after changes. Where practical, we can update the website’s code and components so it can run on a current, patched PHP version. For older systems, we will explain the limits and options before promising a particular upgrade path.

If your website is hosted elsewhere, ask your hosting provider whether its PHP packages contain fixes for both CVE-2026-109618 and CVE-2026-109619, whether the relevant services were restarted, and how it verified the installed build. A firewall rule can reduce exposure while work is underway, but it is not a replacement for the PHP fix.

The Good News:  All php packages on Muskoka Graphics servers have been updated to the latest packages protecting any future hacking due to these vulnerabilities.   This means that your website cannot be affected by it going forward.  It doesn’t however mean that it hasn’t been affected before patches were available.

The Bad News:  While older versions of PHP like 5.6-7.4 have been updated, it’s now being strongly recommended that they be removed from all servers.  PHP 8.1 and lower are no longer supported and are a risk to both websites and servers.  Coming January 1 these older packages will be removed from our servers.  This means some of you with older websites may at least need serious updates (if they have not been contracted to be updated by us or whomever maintains them) or at worst may need to be replaced because the themes used on WordPress are no longer supported and therefore WordPress cannot be updated which means they will not function on higher versions of PHP.  If you have a website that’s say 3 years and older you should verify with us if your site needs updating or is at risk.

Keep in mind Muskoka Graphics does have hosting packages that provide the time needed monthly to update your website packages.  These are called CMS Hosting Packages they are a monthly hosting cost that includes the security certificate.  If you have a regular gold, silver hosting package that is yearly, You can update to the CMS hosting package simply by asking us to switch you over.  This would mean all updates that are necessary to help prevent security hacking will be done monthly automatically by us.  If you do not have one of these packages you can contract us to update your website for you anytime you wish. You may Contact Us Here

If you wish to verify your own PHP version you can do so by logging into the client area on our website, Log into the client area and select the Services Tab, Select your hosting package,  select one of the items like AWStats then in the left sidebar select tools,  scroll down to software and select PHP Selector.  It will then tell you which current version you are using.  If it’s less than 8.1 you should contact us for options. Do not change the setting or you could render your website unusable.

Watch the CBC News Info On This

Take the next step

Please watch for our email if Muskoka Graphics hosts your website. If you know your site is older, or you are unsure who is responsible for its PHP updates, contact Muskoka Graphicsand ask for a PHP security and compatibility review. We can check the immediate patch status and give you a realistic plan to move your website forward.

Technical sources: PHP’s October 21 security releases and CloudLinux’s current package status and verification guidance (reviewed October 23, 2026).