PHP Schedules Emergency Patch for 2 Critical Flaws Today

PHP’s security team will release fixes for two critical vulnerabilities today at 14:00 UTC, according to an advisory it published on October 20.

That matters to any Ecommerce Paradise reader whose store runs on WooCommerce, Magento or a custom PHP build, because PHP is the language running the server that takes your orders. Shopify merchants do not patch PHP on a server they manage, but anyone with a WordPress blog, a landing-page host or a self-hosted checkout does.

Below is what PHP has confirmed, what security firms and a leak are claiming, and where those accounts disagree. After that comes what I’d do before the release goes live. It lands one day after my breakdown of the Adobe Commerce BlockStrap flaw. My report on the Rank Math PRO backdoor ran hours earlier, so plenty of store owners are already in patch mode.

When a server flaw turns into a breach, the legal entity behind your store is the layer built to keep the fallout away from your personal assets, so form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. Northwest has operated for 25 years under stable ownership, which is why I trust it over the cheap formation sites that upsell you after checkout. Form your LLC with Northwest →

PHP Sets a 14:00 UTC Patch for Two 9.2-Rated Flaws

PHP’s advisory, posted on its official news archive on October 20, gives advance notice of an “upcoming security release” scheduled for Wednesday, October 21, 2026 at 14:00 UTC. That is 10:00 AM in New York, 07:00 in San Francisco, 15:00 in London and 21:00 in Bangkok. The notice says it addresses “two critical vulnerabilities, both rated CVSS v4.0 9.2.”

The PHP security team wrote that all users “are encouraged to prepare now so they can upgrade as soon as the release is available.” It also reserved the right to ship early “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” Full details, affected versions and fixed version numbers arrive with the release itself.

That is all PHP has put on the record. The advisory names no CVE, no component and no attack path, and it does not say whether either flaw allows remote code execution.

Security firm watchTowr says it knows more. According to BleepingComputer’s report by Lawrence Abrams, published October 20 at 4:56 PM, watchTowr tracks the bugs as CVE-2026-109618 and CVE-2026-109619 and describes both as remote code execution flaws. It believes they affect PHP 5, 6, 7 and 8. watchTowr CEO Benjamin Harris rated both CVSS 10, and the firm says it reproduced CVE-2026-109618 but is withholding technical detail until patches exist. It also says it has not seen either flaw exploited in the wild.

Which PHP branches can actually receive a fix matters here. Per the PHP supported versions page, security support runs through December 31, 2026 for PHP 8.2, December 31, 2027 for 8.3, December 31, 2028 for 8.4 and December 31, 2029 for 8.5. Hosting provider PrivateDevOps notes in its preparation guide that PHP 8.1, 8.0 and all 7.x releases are end of life, so php.net will not provide fixes for them.

The exposed population is large. Daily CyberSecurity, citing a count from Mallory, reports about 1.5 million internet-facing hosts that disclose a PHP version, and about 59% of them run PHP 8.1 or older. That figure comes from a third party and I could not independently confirm it.

On the numbers that PHP itself controls, today’s release would be its fourth security release since July. The php.net release list shows security releases on July 2 (8.2.32, 8.3.32, 8.4.23, 8.5.8), July 30 (8.2.33, 8.3.33, 8.4.24, 8.5.9) and September 24 (8.2.34, 8.3.35, 8.4.26, 8.5.11). Servers that skipped the September update pick up those fixes as well when they move.

Leaked CVEs and a CVSS 10 Claim: What We Know So Far

The advance notice was not entirely PHP’s choice. Per Daily CyberSecurity, an anonymous Hacker News post on October 20 claimed the two flaws existed, and researcher Kevin Beaumont wrote on Mastodon that “somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.” watchTowr then said on X that the flaws were real, and PHP published its notice the same day.

BleepingComputer saw the Hacker News post before it was deleted. It was written by a user named “petecooper,” claimed disclosure on October 22, listed CVSS 10.0 scores and said affected versions reached back to PHP 5. watchTowr told BleepingComputer the embargoed disclosure had originally been planned for Thursday at 11 AM Eastern, a day after PHP’s official date.

The two accounts disagree on severity. PHP’s official rating is 9.2 on CVSS v4.0, while watchTowr and the leaked post say 10. Daily CyberSecurity says the gap may reflect a different scoring version or an unverified claim, and it does not resolve which. A 9.2 and a 10 are both in the critical band, so the practical urgency is the same, but the number you read depends on who you trust.

There is a real counterpoint to the loudest headlines. As of this writing nobody has confirmed active exploitation or a public proof of concept. Sansec, an ecommerce security vendor, published a research note on October 21 saying the flaws “affect all web servers running PHP 5.4 or later,” but the page I could read had no technical body, and Sansec sells its own Shield and eComscan products, so weigh its framing accordingly. No source has said which server configurations are exposed. That could narrow the real-world risk once details land, or it could widen it.

My point is narrower than either number. Two security firms describe remote code execution, and one says it reproduced a flaw, so this is not a rumor-grade claim. Every minute you spend arguing about 9.2 versus 10 is a minute you are not inventorying your servers.

For context on how fast ecommerce stacks have been moving this week, the Adobe Commerce BlockStrap flaw was rated a 10.0 and the Rank Math PRO downloads carried a backdoor. Another WordPress plugin problem, covered in my Ninja Forms hidden admin report, showed how a single flaw can plant hidden admin accounts on a store.

What the PHP Patch Means for WooCommerce and Magento Stores

My read is that this is a hosting problem first and a store problem second. If your site runs on a self-hosted PHP stack, your exposure depends on who controls the PHP binary, how fast they patch, and whether the version you run can be patched at all.

I sort store owners into three groups. The first group is on managed hosting where the host updates PHP for you. Your job is to confirm that it happened, not to do it. The second group runs its own VPS or an unmanaged cloud box, so every step in the patch is yours. The third group runs PHP 8.1 or older, and for you the patch may simply not exist. That third group has the real problem, because the fix is a version upgrade, and version upgrades break old themes and plugins.

Now the rough math, and this is a hypothetical, not a reported figure. A WooCommerce store grossing $50,000 a month is moving about $1,667 a day. If a compromised checkout server forces a two-day shutdown, that is roughly $3,300 in missed sales before you count cleanup, refunds, chargebacks or lost ad spend on traffic you paid to send to a dead site. If you run Google Shopping ads, the clicks keep billing while the store is down. My guide to chargeback prevention for high-ticket stores covers what a bad week does to your dispute ratio.

Payment data deserves a separate thought. If your checkout uses hosted payment fields from your processor, card numbers never touch your server, which limits one category of damage. Remote code execution can still read your database, your admin sessions and your API keys, and anything saved there is exposed. That is why I would never run a store that depends on one payment path, a point I made in my post on payment processor backup plans.

The threshold I’d use is simple. If your store does more than a few thousand dollars a month and runs on self-managed PHP, treat the 14:00 UTC release as a same-day task. Under that, you can afford to wait for your host’s confirmation, but not past the weekend. If you are on PHP 8.1 or older, schedule the upgrade now, because waiting for a patch that will not come is not a plan.

This is also the clearest argument I can make for hosted platforms. A store on Shopify does not run on a server you maintain, so there is no PHP binary for you to patch. A WooCommerce store gives you more control and more of these mornings.

I wrote up the real trade-offs in my WooCommerce pricing breakdown. The same logic applies to every plugin you add, which my guide to WooCommerce dropshipping plugins makes clear, because each one is more code you depend on.

If you stay on WordPress, move to a host that treats PHP versions as its job. WordPress itself says it is recommended your host supports PHP 8.3 or greater. I’d shortlist Cloudways first.

Liquid Web is the other name on my list. My review of Pressable, the WooCommerce host Automattic built, covers a third route. Confirm the PHP policy in writing before you move.

If you would rather not own any of this, that is what the turnkey done-for-you service is built for. My team builds and runs high-ticket stores for you, and platform choice is part of that build.

Patch days are a tax on owners who run their own servers, so would you rather have my team build and run the store for you? See the turnkey done-for-you service →

Patch Your Store’s PHP Stack in 6 Steps

Do these in order. The first three can happen before the release goes live.

Inventory every PHP install. Run php -v on each server, and check the PHP version setting in your host’s control panel for every site, including old staging sites and forgotten landing pages. PrivateDevOps lists whmapi1 php_get_installed_versions for cPanel servers and plesk bin php_handler --list for Plesk. Shared hosts that run several PHP versions need every handler updated, not just the default.
Find your branch and your deadline. If you are on 8.2, you have security support only until December 31, 2026, so plan the move to 8.4 or 8.5 now. If you are on 8.1 or older, book the upgrade this week and test your theme and plugins on a staging copy first.
Take a fresh backup and message your host. Ask support one question in writing: will you apply the October 21 PHP release to my plan, and when? If you host on SiteGround or a similar provider, open that ticket from the dashboard so the reply gives you a timestamp you can point to later.
Apply the update when it lands, then restart. PHP-FPM and Apache with mod_php keep running old code until restarted. On Debian and Ubuntu the version number often stays the same because fixes are backported, so check the package changelog rather than the version string. Rebuild containers from a fresh base image.
Pre-write your customer message. If checkout goes down, you want the email and the support macro ready. Draft the notice in Klaviyo and the canned reply in Gorgias today, then leave them in drafts. For high-ticket buyers who phone in, a status line on your phone greeting works just as well.
Verify, then audit admins. Test a live page and run a test order. Set an uptime alert if you do not have one, and my roundup of the best uptime monitoring tools for ecommerce stores will save you the shopping. Then review every admin account and rotate passwords, because a patch does not remove access an attacker already took.

If you want a second set of eyes on your hosting and stack before Black Friday traffic arrives, book a discovery call and tell me what you run. My high-ticket Black Friday stress test is a good companion to this list.

For the recovery side after an outage, use the e-commerce business continuity plan.

Frequently Asked Questions

Does this affect Shopify stores?
Not through a server you manage. Shopify runs its own platform, so there is no PHP install for you to patch. Your exposure is any side site you run on PHP, such as a WordPress blog or a landing-page host, and apps that connect to your store, a risk I covered in three Shopify apps hijacked to fake checkouts.

Will my host patch PHP automatically?
Managed hosts usually do, but timing varies, and Docker images and distribution packages update on their own schedules. Ask support for a written confirmation and verify the version yourself after the release. If your host cannot say when, treat that as information about the host.

Which PHP version should I run?
WordPress recommends 8.3 or greater. PHP 8.4 or 8.5 gives you the longest security runway, through December 31, 2028 and December 31, 2029, per php.net. Test plugins on staging before you switch production.

Should I take my store offline until the patch is out?
PHP has not published a workaround, and I would not improvise one. Nobody has confirmed active exploitation, so the plan is to be ready to patch within hours of the release, not to shut down your revenue today. If PHP releases early because of exploitation, move immediately.

How will I know the patch is out?
Watch the news page on php.net, where the advance notice appeared, and your host’s status page. The release is scheduled for 14:00 UTC, and PHP can move it earlier.

What does an LLC do if my store is breached?
An LLC is designed to separate business liabilities from your personal assets, though the protection depends on your state and on running the company properly. I am not a lawyer, so ask one how it applies to you, and read my piece on protecting your business finances in a legal emergency.

Where should a new store owner start if server patching sounds like too much?
Start with a hosted platform and a proven niche. My free high-ticket niches list gives you product categories to research. My guide to high-ticket dropshipping explains the model itself.

Want to work through patch days and everything else with other store owners and me inside the community? Join the Skool community →

Once PHP publishes the CVE details and fixed version numbers, those override everything above. Until then, the work is the inventory, the backup and the host ticket. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.