Critical PHP flaw: update now, then think static

On 21 October 2026, the PHP team released a security update fixing two critical flaws. On social media, people said “80% of the internet” was at risk and that attackers would figure it all out “in 15 minutes”. The reality is a little less dramatic, but still serious. Here is what is true, what to do today, and the question this alert raises for anyone running a WordPress or PrestaShop site.

What was fixed

The two flaws are CVE-2026-109618 and CVE-2026-109619. The PHP team rates them 9.2 out of 10 in its announcement on php.net. In both cases, a visitor who is not logged in can make the server run their own code. The first comes from poor handling of memory when it runs out. The second comes from data left over from one request that the next request reuses.

Every installation that serves web pages is affected, whatever the setup: PHP-FPM, Apache with mod_php, LiteSpeed, FrankenPHP. According to php.net, mod_php is the most exposed, with an attack demonstrated before the site’s own code even runs.

The “80% of the internet” figure is rounded up. PHP runs the large majority of sites whose technology is known, which includes nearly every WordPress, PrestaShop, Drupal and Joomla site. The threat is broad, but not universal.

What to do today

Update PHP. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your host manages PHP for you, check that it has done so, or ask in writing.

If your site still runs PHP 8.1 or older, the PHP project no longer ships releases for those branches. Its team only published raw patches that your host has to apply itself. That is the signal that an upgrade cannot wait any longer.

Until you update, php.net suggests settings that reduce the risk, such as turning off upload progress tracking. The PHP team says it plainly: these settings do not make a server safe, only the update does.

Why AI shortens the window

A security update shows exactly which lines changed. Attackers compare the old and new versions to find the flaw, then write an exploit. That used to take days. With today’s coding assistants, it can take a few hours. The tweet’s “15 minutes” is a prediction, not an observed fact, but the trend is real: the gap between a fix being published and the first attacks keeps shrinking.

For a business, that changes the rules. Updating “within the week” is no longer enough for a flaw of this level. You need to update within the day, which means someone has to watch, test and deploy, weekends included.

The real advantage of a static site

A static site is built once, ahead of time. What the visitor receives are ready-made files: HTML, images, a little JavaScript. No PHP runs during the visit, and no database is queried. A flaw like this one simply has nothing to attack.

This is the most underrated benefit of static sites. People mostly talk about speed, but static also cuts your dependence on one specific technology. Your site no longer depends on the PHP version, the WordPress version, or thirty plugins that all have to be up to date at once. Fewer moving parts means fewer emergencies like today’s.

What static does not solve

To be honest, static does not remove all security work.

• Forms still need a small service to receive submissions. It has to be protected, but it is tiny compared with a whole WordPress install.
• The back office still exists if you use an editing tool such as a headless CMS. It lives separately, with a vendor that maintains it, not on the server of your public site.
• APIs for payment, booking or catalogues are still software to keep up to date.
• A full online shop, with cart and customer accounts, does not turn static overnight. Product pages and content can, and payment goes through a specialised service.

The difference is that the exposed surface becomes small and clearly bounded. Instead of watching a whole server, you watch two or three specific pieces.

The right moment to ask the question

If this alert made you rush to check your PHP version, ask yourself a simple question: does your site really need to run code on every visit? For a company site, a blog or a catalogue, the answer is almost always no.

Start by updating today. Then, if you want to get out of this cycle of alerts, our static site migration keeps all your addresses and rankings, and puts the site on hosting that runs no PHP at all. To see what happens when the update comes too late, also read what to do when a WordPress site is hacked.