Last Updated: 23 October 2026

Your domain name is an important part of your online identity. Whether you run a business website, an online store, or a personal website, keeping your online presence secure is essential. However, website security involves more than registering a domain name or configuring DNS settings. The software running behind your website must also be kept up to date.

 

On 21 October 2026, the PHP development team released critical security updates to address two vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow attackers to execute malicious code remotely on affected servers without authentication. Both have a reported CVSS severity score of 9.2. Because PHP is widely used to run websites and web applications, website owners and server administrators should check whether their hosting environments are affected and apply the appropriate security updates as soon as possible.

 

What Are These PHP Vulnerabilities?

PHP is a server-side programming language used by many popular websites, including WordPress sites, business websites, online stores, and custom web applications. The newly reported vulnerabilities affect the way PHP handles memory and internal request data. If an affected installation is successfully exploited, an attacker may be able to execute malicious code on the server.

 

CVE-2026-109618: Out-of-Memory Corruption

This vulnerability is related to how PHP handles an out-of-memory condition during request processing. Under certain circumstances, PHP may attempt to process internal data that has not been fully initialized. This can cause memory corruption and potentially allow an attacker to execute malicious code remotely.

CVE-2026-109619: Stale Internal State

This vulnerability involves internal request data that may remain accessible after the memory associated with it has been released. A later request handled by the same PHP worker may use this outdated state before it is properly reset. Under certain conditions, this behavior may also lead to remote code execution. These vulnerabilities affect the PHP runtime rather than a particular domain extension, DNS record, website theme, or plugin. Updating website content alone will not resolve the underlying PHP security issue.

 

Who Could Be Affected?

Websites and applications running vulnerable PHP installations should be assessed, regardless of their domain extension or hosting provider. Potentially affected environments include:

  • WordPress websites and other content management systems.
  • Business websites and company portals.
  • E-commerce websites and online stores.
  • Custom PHP applications and websites built with frameworks such as Laravel.
  • Websites running on shared hosting, VPS, or dedicated servers.
  • Applications using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.

The PHP development team has identified Apache with mod_php as a particularly high-risk configuration. However, other PHP environments should not be assumed safe without checking their installed versions and security patches. If your website appears to work normally, that does not necessarily mean the underlying software is secure.

 

Which PHP Versions Require Security Updates?

The PHP development team has released fixes for the following PHP branches:

PHP Branch Fixed Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

 

These releases address both CVE-2026-109618 and CVE-2026-109619. Earlier releases within these branches should be updated to the appropriate fixed version.

 

What about older PHP versions?

PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. However, some operating system vendors and extended-support providers may offer security patches for selected older releases. If your website depends on an older PHP version, contact your hosting provider or software vendor to confirm whether an applicable patch is available. Where possible, plan to move to a supported PHP version after checking your website's compatibility.

 

The displayed PHP version number alone may not always confirm whether an installation is protected, because some vendors provide security fixes through updated packages without changing the main version number. For the complete release details, refer to the  official PHP security advisory.

 

What Should Website Owners Do?

Taking a few practical steps can help you identify potential risks and keep your website operating securely.

 

1. Check Your Website's PHP Version

Find out which PHP version your website uses. If you manage multiple websites or subdomains, check each one because they may use different PHP versions. Your hosting control panel or hosting provider can help you identify the PHP version used by your website.

 

2. Confirm That Security Updates Have Been Applied

If your hosting provider manages the server, contact its support team to confirm that the required PHP security updates have been installed. If you manage your own VPS or dedicated server, check the installed PHP packages and apply the appropriate vendor security updates. Simply selecting a newer PHP version in a control panel does not necessarily mean that every PHP installation or server component has been updated.

 

3. Keep Your Website Software Up to Date

Although this particular issue affects PHP itself, it is still important to maintain your content management system, themes, plugins, and other application components. Regular software updates help reduce exposure to known vulnerabilities and improve the overall security of your website.

 

4. Maintain a Recent Backup

Before making significant software or server changes, ensure that a recent backup of your website files and databases is available. After the update, test the website to confirm that its main features are working correctly. If you suspect that your website was compromised before the security patch was applied, investigate the incident rather than assuming that the update has removed all malicious changes.

 

5. Monitor for Unusual Activity

Website owners and administrators should pay attention to unexpected errors, suspicious file changes, unfamiliar processes, or unusual server activity. If you suspect unauthorized access, contact your hosting provider or a qualified security professional to investigate. Applying a security patch is essential, but it does not automatically remove malicious changes that may already have occurred.

 

What If Your Website Uses cPanel or Plesk?

If your website is hosted through cPanel or Plesk, the relevant security updates may depend on the installed PHP packages, operating system, and control panel version. Check the official instructions published by your control panel provider, or contact your hosting provider to confirm that the necessary updates have been applied. For detailed guidance, see the cPanel and Plesk references under the More Information section below.

 

How RegisterHere.lk Fits Into Your Website Security

RegisterHere.lk helps individuals and businesses establish their online identity through domain registration and domain management services, including .LK domain registrations and DNS management. Owning a domain is an important first step in building an online presence, but maintaining a secure website also requires attention to the hosting environment and the software running on it.

 

If you have registered your domain through RegisterHere.lk, check which provider hosts your website and contact that provider if you need assistance with PHP security updates. If you use your domain only for registration or DNS management, there is no need to change your domain settings solely because of these vulnerabilities. The appropriate action depends on the PHP software and hosting environment used by your website. You can visit RegisterHere.lk to manage your domain registration and explore our domain services.

 

Final Thoughts

CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that may allow unauthenticated attackers to execute malicious code on affected servers. Website owners should check their PHP versions, confirm that the appropriate security updates have been applied, and contact their hosting providers if they are unsure about their server's status. Your domain name is an important part of your digital identity, but maintaining a secure online presence requires attention to both domain management and website security. By keeping server software updated, maintaining regular backups, and working with the appropriate hosting provider, you can help protect your website and the people who visit it.

 

More Information

For official technical details and platform-specific guidance, refer to these resources: