Is your website exposed to the new PHP flaws?
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disclosed on 21 October 2026, let attackers run their own code on web servers. Here is how to check and fix your site, or let us do it for you.
What happened
On 21 October 2026, the PHP project disclosed two flaws that can let an attacker run their own code on a web server. They affect every version of PHP, the language behind WordPress and most business websites. DigitalOcean has warned all its customers that exploit code is already public.
Are you affected?
Yes, if your website runs on PHP (WordPress, WooCommerce, Drupal, Laravel and most custom sites) and its server has not been updated since 21 October.
Managed hosting such as WP Engine, Kinsta or Cloudways: your host updates PHP for you. Ask them to confirm it is done.
Not affected: Wix, Shopify, Squarespace and Webflow sites.
Fix it yourself
Check your PHP version: in your hosting control panel, in WordPress under Tools > Site Health > Info > Server, or with php -v on the server.
Update to a patched release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
On PHP 8.1 or older? There is no official patch. Upgrade to PHP 8.2 or later first.
Restart PHP and your web server, then check no old PHP process is still running. We found one on our own servers that survived a restart.
Can’t update today? The PHP project lists temporary measures in the advisory. They reduce the risk but do not make the server safe.
Signs you may already be compromised
Administrator accounts you don’t recognise
PHP files inside the uploads folder (wp-content/uploads)
WordPress core or plugin files that differ from the official copies
Scheduled tasks or code snippets nobody on your team added
Want us to fix it?
We patch your server, check it for signs of a break-in and lock it down, usually within a day of getting access.
Scope and price are confirmed in writing before any work starts. We check for known signs of compromise; no check can guarantee a server is clean. Thaiger AI is part of The Thaiger group. We patched The Thaiger’s own servers on 22 October.
sales@thaiger.ai
(+66) 92 091 5381
219/59 Asoke Towers, 15th Floor Soi Sukhumvit 21 Khlong Toei Nuea Watthana Bangkok 10110