22/10/2026
๐จ RUN A WORDPRESS WEBSITE? THIS SECURITY UPDATE NEEDS YOUR ATTENTION!
WEBSAFE SECURITY ADVISORY | Critical PHP Vulnerabilities
Two critical security vulnerabilities have been identified in PHP โ the technology powering WordPress and millions of websites worldwide.
โ ๏ธ CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)
These vulnerabilities could allow attackers to execute malicious code on affected website servers without needing to log in. Security patches are now available.
What should website owners and administrators do?
Check your PHP version and confirm whether your server has received the latest security patches.
Contact your hosting provider or IT support team to confirm both vulnerabilities have been addressed.
Back up your website files and database before making changes.
Apply the appropriate PHP security updates and test your website afterwards.
Monitor for suspicious activity, unexpected files or unusual website behaviour.
IMPORTANT: Updating WordPress alone does NOT patch PHP. Your server's PHP environment must also be updated.
A brief maintenance outage may be necessary depending on your hosting environment and update process.
For website visitors: No immediate action is required. Website owners and administrators are responsible for applying the necessary security updates.
READ THE FULL WEBSAFE SECURITY ADVISORY
We've published a detailed advisory covering the vulnerabilities, affected website platforms, recommended security actions, patched PHP versions and official references.
WebSafe Samoa Security Advisory:
https://websafe.ws/2026/10/22/critical-php-security-update-october-2026/
Official CERT-EU Security Advisory:
https://cert.europa.eu/publications/security-advisories/2026-018
Need assistance checking your website? Contact WebSafe Samoa for help reviewing your PHP version, hosting security and website protection.
Stay informed. Stay protected. Stay WebSafe.