Kanorio Marketing Team · Published Oct 22, 2026
Your website is running fine and you haven't received any alerts, so why are you suddenly being asked to perform an emergency PHP update? On October 21, 2026, Japanese Prime Minister Sanae Takaichi issued a public statement urging website administrators to apply PHP patches, bringing much-needed attention to this technical security issue.
If you use WordPress, the most critical thing to confirm is: Has the PHP version actually running on your server been patched? Updating plugins in your WordPress dashboard is not a substitute for patching PHP at the server level.
This guide covers the details of these vulnerabilities, how to check your version, steps for different hosting environments, and what to do if you cannot update, encounter errors, or suspect a breach. Even if you are not an engineer, you will know who to contact and what to verify.
References: Sanae Takaichi's Public Statement, PHP Official Security Announcements
This announcement involves two PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These could allow an unauthenticated attacker to execute code in affected environments. The issue lies within the PHP execution environment, not in any specific WordPress plugin.
Think of WordPress as your content management tool and PHP as the foundation that powers it. Even if WordPress itself is updated, the underlying PHP may still require separate attention. Officials have also warned that the risk is not limited to a single server deployment method.
However, "a site has a vulnerability," "a site is temporarily offline," and "a site has been breached" are three different things. For example, the Japanese Ministry of Finance announced a temporary suspension of certain services to perform emergency checks and patching. Such preventive downtime should not be automatically interpreted as a site being hacked.
For website owners, the priority is to verify your own environment now rather than waiting for anomalies to appear.
References: PHP Official Security Announcements, Japan Ministry of Finance | Notice of Temporary Service Suspension due to PHP Vulnerabilities
Go to your WordPress dashboard, navigate to "Tools → Site Health," and switch to the Info tab to view server-related information. The interface name may vary slightly depending on your version and language. Alternatively, ask your hosting provider for the exact PHP version currently running on your site.
Do not just record "PHP 8"; get the full version number. Different sites under the same hosting account may use different versions, so check each one individually.
References: WordPress | Site Health Screen
As of the update date of this article, the official PHP patched versions are as follows:
| PHP Branch | Current Patch Version | Action Required |
|---|---|---|
| PHP 8.2 | 8.2.35 | Update to this version or a later version containing the same patch |
| PHP 8.3 | 8.3.36 | Update to this version or a later version containing the same patch |
| PHP 8.4 | 8.4.27 | Update to this version or a later version containing the same patch |
| PHP 8.5 | 8.5.12 | Update to this version or a later version containing the same patch |
| PHP 8.1 and older | Not applicable to standard update path | Confirm backported fixes with your vendor and schedule an upgrade |
Some Linux distributions or long-term support (LTS) providers backport fixes to existing packages, so you cannot judge solely by the version number on the screen. If your host claims to be patched, ask for the corresponding announcement, package version, or patch log to confirm it covers both CVEs.
Even if an old branch receives this backport, it does not mean it has regained full long-term security support.
References: CERT-EU | PHP Critical Vulnerability and Patching Recommendations
| Website Environment | Primary Contact | Key Items to Confirm |
|---|---|---|
| Shared/Virtual Hosting | Hosting Support | Is the patch applied? Do you need to switch PHP versions manually? When will it take effect? |
| Managed WordPress | Managed Service Provider | Is the PHP update included in your service? Completion timeline and verification results |
| Self-managed VPS/Cloud | Engineer or System Admin | Are all public-facing instances updated? Have old processes been replaced? |
| Outsourced Site with Unclear Maintenance | Development Agency and Hosting Provider | Who is responsible for patching, testing, and reporting completion? |
This table provides contact and division of labor suggestions; actual responsibility must be confirmed based on your service contract. Just because someone else built your site does not mean they are automatically handling your ongoing PHP updates.
Operational Reminder and Disclaimer: This article is based on official announcements as of October 22, 2026, and is for reference only. It does not constitute a security diagnosis or guarantee for any individual site. Compatibility with different hosts, themes, and plugins may vary. Before taking action, ensure you have a restorable backup and confirm the procedure with your host or maintenance team. If you suspect a breach, a separate investigation is required; a successful update does not automatically confirm security.
Before updating, ensure you have backups of both your site files and database, and confirm who is responsible for restoration. Simply downloading your posts is usually not enough to restore the entire site.
Do not leave an unpatched site exposed while waiting for backups or testing. If you cannot act immediately, ask your maintenance team to evaluate restricting external access before proceeding with backups and updates.
If you suspect a breach, preserve logs and environment snapshots first. Label these snapshots as "under investigation" and do not use them as clean backups.
References: WordPress | Preparing for PHP Updates, WordPress | FAQ: My Site Was Hacked, CERT-EU | Patching and Isolation Recommendations
Shared hosting users should follow the host's announcements or support instructions. If your control panel only offers a choice between "8.3" or "8.4," confirm the actual patched version running in the background.
For self-managed servers, system administrators should update based on the OS, package source, or container deployment method. This article does not provide universal commands because package names and service management vary by environment.
The focus of this patch is the PHP execution environment. WordPress core, themes, and plugins should still be kept up to date, but these updates do not count as patching PHP.
References: PHP Official Security Announcements
Ask your maintenance team to confirm that services have been restarted or redeployed according to your setup and are no longer using old PHP processes. If you have multiple servers or containers, check each one individually.
Do not rely solely on the PHP version shown in the command line. The command line and the web service may use different execution environments; verification must include the service actually responding to visitor requests.
This is the practical key to update validation: the package is downloaded, the control panel is switched, and the site is using the patched version—do not rely on just one of these.
We recommend at least completing the following checks:
This checklist is for basic functionality and patching confirmation; it is not a substitute for a full forensic investigation or security audit.
For example, a design studio on shared hosting, upon receiving the vulnerability news, can list their site URL and PHP version, ask the host to confirm the patch, and then have their developer test the portfolio page and inquiry form. The basis for completion should be the patch log and test results, not just "the home page loads." This is an example process, not a real client event.
Do not treat plugins or firewalls as a complete fix.
Cloudflare has announced protection measures for this vulnerability, but you still need to update PHP. Whether traffic is actually passing through the protection, whether the rules apply, and whether the origin server has other directly accessible paths are all things administrators must verify.
If you cannot patch in the short term, CERT-EU recommends evaluating isolating affected services from the public internet until they are patched and verified. Temporary technical settings have limitations and should be evaluated by maintenance personnel; we do not recommend that general site owners copy unfamiliar settings.
Especially note: Enabling WordPress maintenance mode does not necessarily prevent requests from reaching the vulnerable PHP. Some attack paths may trigger before the application executes, so a maintenance page cannot be considered a complete isolation.
References: Cloudflare | PHP Vulnerability Protection, CERT-EU | PHP Critical Vulnerability Handling
Errors after an update may be related to compatibility with themes, plugins, or custom code. Ask your maintenance team to check error logs and adjust the relevant components.
Do not revert your public site to an unpatched PHP version just to restore the display. If you must revert the environment for troubleshooting, restrict external access first, then arrange for a working, patched version.
References: WordPress | PHP Update and Compatibility
These are red flags that require investigation, but do not assume they are caused by this specific vulnerability alone.
Contact your host or security team, preserve access logs, error logs, and environment snapshots. Isolate the site, clean or rebuild the environment as needed, and handle potentially compromised account credentials. Do not rush to delete suspicious files, as this prevents further investigation.
Updating PHP fixes the vulnerability, but it does not automatically remove backdoors that have already been planted. Similarly, when restoring backups, verify the backup time, content integrity, and whether the restored environment is patched.
References: WordPress | FAQ: My Site Was Hacked
This incident is a reminder for small brands: when choosing a website builder, confirm who is responsible for future security updates and incident handling.
For example, Kanorio uses the Cloudflare edge network for public sites, providing DDoS mitigation and WAF protection, while automatically managing SSL certificates and HTTPS connections, reducing the work brands need to do for basic security. However, these measures do not mean zero risk; owners must still protect their accounts and watch for anomalies. This article does not imply that the platform is completely unaffected by this vulnerability.
Learn more: Kanorio Website Security
Yes, these are separate. WordPress is the application; PHP is the underlying execution environment. The focus of this patch is PHP; please obtain confirmation of patching from your host.
Just because the site loads does not mean there is no risk. Confirm your patch status as soon as possible. If you cannot update immediately, discuss restricting access or pausing services with your maintenance team.
It is possible the provider is using backported fixes. Ask your host for the package details or security advisory to confirm it covers CVE-2026-109618 and CVE-2026-109619. Do not rely solely on verbal assurances.
References: PHP Official Security Announcements
Not necessarily. The backup may contain malicious content, and the restored environment might still be using unpatched PHP. If you suspect a breach, separate investigation and verification are required.
References: WordPress | FAQ: My Site Was Hacked
If you don't know where to start, find your host or maintenance contact and confirm three things: Which PHP version is actually in use, whether these two vulnerabilities are patched, and who will verify the site's functionality after the update.
For studios and small brands without engineering resources, consider security updates and maintenance responsibilities when evaluating future website services. You can learn about the basic protections provided by our platform in the and arrange maintenance according to your site's needs.