Follow us on:
© Copyright 2026 HMMBiz Web Solutions. All rights reserved.
A critical flaw in PHP lets attackers take over a website without a password. It affects most PHP sites, including WordPress, WooCommerce and Magento.
We'll check yours for free and tell you plainly whether it needs fixing.
CVE-2026-109618 · CVE-2026-109619 · fixed in PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12
SEVERITY SCORE (CRITICAL)
FIRST ATTACK ATTEMPT SEEN
FIX AFTER YOUR APPROVAL
GLOBAL CLIENTS
FREE SITE CHECK
Send us your website address. Within one working day, our team replies with one of three answers:
No obligation. We only look at what your website shows publicly until you ask us to go further.
CHECK IT YOURSELF IN 2 MINUTES
Each PHP line got its own fixed release on 21 October 2026. Anything older than these numbers, or on a version that no longer gets security fixes, needs attention.
Where to find it: WordPress → Tools → Site Health → Info → Server. In cPanel → Select PHP Version or MultiPHP Manager.
WHO MAY BE AFFECTED
Blogs, business websites and portfolios. Updating WordPress or plugins does not fix PHP2Shell.
WooCommerce, Magento and Shopware stores are exposed even when their own code is clean.
Laravel, CodeIgniter and bespoke PHP web apps, portals and dashboards.
PHP 8.1, 7.4 and older get no official fix and need an upgrade with testing.
WHY IT NEEDS CARE
Moving from PHP 7.4 or 8.1 to 8.3 or 8.4 is a big step. Old themes, plugins and custom code can break, often on the checkout or contact form, unless they are tested first.
Attack attempts were seen before the fix was released. Updating PHP closes the door, but it won't remove a hidden file or an extra admin account left behind.
Some hosts update PHP for you, others leave it to you. On a VPS or cloud server, it is usually your responsibility or your developer's.
HOW WE FIX IT
We tell you if your website is affected. No obligation.
Files and database, before anything changes.
Theme, plugins and custom code tested on the new PHP version.
The newest fixed release your website can safely run.
PHP features your website doesn't use are switched off.
Forms, checkout, logins, search and key landing pages.
Unknown files, new admin accounts and changed code.
Then a plain-language completion report.
Flat fee per website, quoted after your free check. Most fixes are completed within 48 hours of approval. We patched the servers we manage within 24 hours of the official fix.
THE NEXT DEADLINE
If your website is being upgraded now, go straight to PHP 8.3 or 8.4 where it is compatible. You test once, instead of again in ten weeks.
31 Dec
END OF PHP 8.2 SECURITY SUPPORT
FOR AGENCIES
The same seven steps, delivered under your brand, with a ready-to-send note for your clients and partner rates from 10 websites.
FAQ
Sources: PHP security advisory · Sansec · Tenable · Help Net Security · Malwarebytes
Follow us on:
© Copyright 2026 HMMBiz Web Solutions. All rights reserved.