{"id":26076,"date":"2026-10-21T11:30:07","date_gmt":"2026-10-21T11:30:07","guid":{"rendered":"https:\/\/newblog.siteground.com\/en\/?p=26076"},"modified":"2026-10-22T11:39:31","modified_gmt":"2026-10-22T11:39:31","slug":"critical-php-vulnerabilities-october-2026","status":"publish","type":"post","link":"https:\/\/www.siteground.com\/blog\/critical-php-vulnerabilities-october-2026\/","title":{"rendered":"SiteGround moves early to protect customers ahead of critical PHP security release"},"content":{"rendered":"\n<div class=\"post-page__colored-blocks post-page__colored-blocks--update\"><p class=\"text text--size-medium color-darkest\"><em>Last updated: 22 October 2026, 12:00 UTC. <strong>PHP has released the fixes, and they\u2019re now applied across all SiteGround servers.<\/strong><\/em><\/p><\/div>\n\n\n\n<p>PHP has announced two critical vulnerabilities, <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2026-109618<\/a> and <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-109619\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2026-109619<\/a>, both rated 9.2 on the CVSS v4.0 scale<strong>.<\/strong> PHP fixed both in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. According to <a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" target=\"_blank\" rel=\"noreferrer noopener\">W3Techs<\/a>, PHP runs on 69.3% of websites whose server-side language is known, WordPress sites included. That means a flaw in the language itself reaches much further than a bug in a single plugin or theme.<\/p>\n\n\n\n<p><strong>If your site is hosted with SiteGround, you\u2019re already protected. Our security team put protective measures in place across all our servers before the official release, then applied PHP\u2019s official fixes the same day. There\u2019s nothing you need to do.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Key points at a glance<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What happened: PHP disclosed two critical vulnerabilities in the language itself, CVE-2026-109618 and CVE-2026-109619.<\/li>\n\n\n\n<li>Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026.<\/li>\n\n\n\n<li>SiteGround clients: Protected before the release, official fixes applied immediately after. No updates, settings changes or PHP version switches needed.<\/li>\n\n\n\n<li>Sites hosted elsewhere: Update PHP to a fixed version now.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What SiteGround has already done<\/strong><\/h3>\n\n\n\n<p>After PHP\u2019s advance notice, our security team assessed the available information and rolled out server-level mitigation rules across all SiteGround servers. We disabled the affected functionalities on all supported PHP versions. Once PHP released the fixes on 21 October, we applied them across all SiteGround servers.<\/p>\n\n\n\n<p>You don\u2019t need to update anything or change your PHP version. As a managed platform, we handle this at the server level, so the protection applies to your site automatically.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Why acting before the release matters<\/strong><\/h3>\n\n\n\n<p>The riskiest time for any critical vulnerability is right after the details go public, when attackers start scanning for servers that haven\u2019t been updated yet. Because we acted before the release, our servers are already protected when that window opens. We\u2019ll keep monitoring the release and take any further steps needed to keep your sites safe.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What we know about CVE-2026-109618 and CVE-2026-109619<\/strong><\/h3>\n\n\n\n<p>PHP announced the security release in an <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-20-1\" target=\"_blank\" rel=\"noreferrer noopener\">advance notice on php.net<\/a> on 20 October 2026. In it, PHP confirmed:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Two vulnerabilities, both rated critical with a CVSS v4.0 score of 9.2<\/li>\n\n\n\n<li>A security release scheduled for 21 October 2026 at 14:00 UTC<\/li>\n\n\n\n<li>Full technical details, affected versions and fixed versions will be published with the release<\/li>\n<\/ul>\n\n\n\n<p>PHP has since published the full details in its <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noreferrer noopener\">security advisory<\/a>. Both vulnerabilities can allow unauthenticated remote code execution and are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>If you run PHP outside SiteGround<\/strong><\/h3>\n\n\n\n<p>If you use PHP on another hosting provider, your own server or a local development setup, follow PHP\u2019s advice and upgrade as soon as fixed versions are available. Check php.net for the official advisory and the list of patched versions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Proactive security by design<\/strong><\/h3>\n\n\n\n<p>We were able to move ahead of this release because of how we run our platform:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>An in-house security team.<\/strong> Our security specialists monitor vulnerability disclosures around the clock and assess new threats as soon as information becomes available.<\/li>\n\n\n\n<li><strong>Engineers on call 24\/7.<\/strong> Protective measures go out when they\u2019re ready, not when the next business day starts.<\/li>\n\n\n\n<li><strong>A fully managed server environment.<\/strong> We run and maintain our hosting infrastructure ourselves, so we can roll out protections across every server at once instead of waiting for each site owner to act.<\/li>\n<\/ul>\n\n\n\n<p>We\u2019ve used the same approach in our earlier responses this year, when <a href=\"https:\/\/www.siteground.com\/blog\/siteground-patched-linux-kernel-exploits-zero-downtime\" target=\"_blank\" rel=\"noreferrer noopener\">we patched five Linux kernel exploits<\/a> in 48 hours with zero downtime, and <a href=\"https:\/\/www.siteground.com\/blog\/critical-updraftplus-vulnerability-patched\" target=\"_blank\" rel=\"noreferrer noopener\">updated UpdraftPlus on every affected WordPress site<\/a> in less than an hour.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Protection that doesn\u2019t wait<\/strong><\/h3>\n\n\n\n<p>Most of our security work never makes it to the blog. We monitor, patch and harden our servers every day, whether or not a vulnerability is in the news. This release gets a post because PHP sits under so many websites, but our response followed the usual approach: spot the risk early, act on our servers, and keep your site protected without adding anything to your to-do list.<\/p>\n\n\n\n<p>Hosting with us means this is our job, not yours. Our <a href=\"https:\/\/www.siteground.com\/tutorials\/getting-started\/getting-help-from-our-support-team\" target=\"_blank\" rel=\"noreferrer noopener\">support team<\/a> is available 24\/7 if you have any questions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-frequently-asked-questions\"><strong>Frequently asked questions<\/strong><\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1792581657276\"><strong class=\"schema-faq-question\"><strong>What are CVE-2026-109618 and CVE-2026-109619?<\/strong><\/strong> <p class=\"schema-faq-answer\">They\u2019re two critical vulnerabilities in the PHP programming language, both rated 9.2 on the CVSS v4.0 scale. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.<\/p> <\/div> <\/div>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1792581665245\"><strong class=\"schema-faq-question\"><strong>Is my website on SiteGround affected?<\/strong><\/strong> <p class=\"schema-faq-answer\">No action is needed. SiteGround has already put protective measures in place across all its servers, so sites hosted with us are covered at server level.<\/p> <\/div> <\/div>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1792581671881\"><strong class=\"schema-faq-question\"><strong>Do I need to update PHP or change my PHP version on SiteGround?<\/strong><\/strong> <p class=\"schema-faq-answer\">No. SiteGround manages PHP at server level, so the protection applies to your site without any change on your end.<\/p> <\/div> <\/div>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1792581686305\"><strong class=\"schema-faq-question\"><strong>Are WordPress sites affected by PHP vulnerabilities?<\/strong><\/strong> <p class=\"schema-faq-answer\">WordPress runs on PHP, so a flaw in PHP can affect WordPress sites regardless of which plugins or theme they use. On SiteGround, your WordPress site is already protected.<\/p> <\/div> <\/div>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1792581693677\"><strong class=\"schema-faq-question\"><strong>What should I do if my site is hosted elsewhere?<\/strong><\/strong> <p class=\"schema-faq-answer\">Check with your hosting provider, or upgrade PHP yourself as soon as fixed versions are available on php.net.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"Last updated: 22 October 2026, 12:00 UTC. PHP has released the fixes, and they\u2019re now applied across all SiteGround servers. PHP has announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. PHP fixed both in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. According to W3Techs,&hellip;","protected":false},"author":136,"featured_media":26090,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2018,12],"tags":[2095],"class_list":["post-26076","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-product-updates","category-security","tag-user-area-display"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.7 (Yoast SEO v26.7) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Critical PHP vulnerabilities: SiteGround sites protected<\/title>\n<meta name=\"description\" content=\"PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619. SiteGround protected all its servers before the release. No action needed.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SiteGround moves early to protect customers ahead of critical PHP security release\" \/>\n<meta property=\"og:description\" content=\"Last updated: 22 October 2026, 12:00 UTC. PHP has released the fixes, and they\u2019re now applied across all SiteGround servers. PHP has announced two\" \/>\n<meta property=\"og:url\" content=\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"SiteGround\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/siteground\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T11:30:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T11:39:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Aleksandar Kolev\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@siteground\" \/>\n<meta name=\"twitter:site\" content=\"@siteground\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aleksandar Kolev\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\"},\"author\":{\"name\":\"Aleksandar Kolev\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/cb7243a505466cc04641e011eb97c94d\"},\"headline\":\"SiteGround moves early to protect customers ahead of critical PHP security release\",\"datePublished\":\"2026-10-21T11:30:07+00:00\",\"dateModified\":\"2026-10-22T11:39:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\"},\"wordCount\":862,\"commentCount\":24,\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg\",\"keywords\":[\"user-area-display\"],\"articleSection\":[\"Product Updates\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\",\"name\":\"Critical PHP vulnerabilities: SiteGround sites protected\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg\",\"datePublished\":\"2026-10-21T11:30:07+00:00\",\"dateModified\":\"2026-10-22T11:39:31+00:00\",\"description\":\"PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619. SiteGround protected all its servers before the release. No action needed.\",\"breadcrumb\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276\"},{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245\"},{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881\"},{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305\"},{\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg\",\"width\":1200,\"height\":600,\"caption\":\"Man working on a laptop with security graphics showing PHP protection, a blocked threat, and a software update.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/newblog.siteground.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SiteGround moves early to protect customers ahead of critical PHP security release\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"name\":\"SiteGround Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\",\"name\":\"SiteGround Blog\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"width\":1200,\"height\":400,\"caption\":\"SiteGround Blog\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/siteground\",\"https:\/\/x.com\/siteground\",\"https:\/\/www.instagram.com\/siteground\/\",\"https:\/\/www.youtube.com\/@siteground\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/cb7243a505466cc04641e011eb97c94d\",\"name\":\"Aleksandar Kolev\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e052d4b0a923379bef2baff3319f7dbe?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e052d4b0a923379bef2baff3319f7dbe?s=96&d=mm&r=g\",\"caption\":\"Aleksandar Kolev\"},\"description\":\"Aleksandar focuses on how hosting infrastructure, performance systems, and platform tools work together to keep websites fast, secure, and reliable. His work translates complex hosting concepts, such as caching, DNS, and server-level optimization, into practical guidance based on real-world scenarios and user needs. Outside of work, he enjoys chess, meditation, playing guitar, and integrating AI systems in his daily life.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/aleksandar-kolev-a62172310\/\"],\"url\":\"https:\/\/newblog.siteground.com\/en\/author\/aleksandarkolev\/\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276\",\"position\":1,\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276\",\"name\":\"What are CVE-2026-109618 and CVE-2026-109619?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"They\u2019re two critical vulnerabilities in the PHP programming language, both rated 9.2 on the CVSS v4.0 scale. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245\",\"position\":2,\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245\",\"name\":\"Is my website on SiteGround affected?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No action is needed. SiteGround has already put protective measures in place across all its servers, so sites hosted with us are covered at server level.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881\",\"position\":3,\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881\",\"name\":\"Do I need to update PHP or change my PHP version on SiteGround?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. SiteGround manages PHP at server level, so the protection applies to your site without any change on your end.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305\",\"position\":4,\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305\",\"name\":\"Are WordPress sites affected by PHP vulnerabilities?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"WordPress runs on PHP, so a flaw in PHP can affect WordPress sites regardless of which plugins or theme they use. On SiteGround, your WordPress site is already protected.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677\",\"position\":5,\"url\":\"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677\",\"name\":\"What should I do if my site is hosted elsewhere?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Check with your hosting provider, or upgrade PHP yourself as soon as fixed versions are available on php.net.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Critical PHP vulnerabilities: SiteGround sites protected","description":"PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619. SiteGround protected all its servers before the release. No action needed.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/","og_locale":"en_US","og_type":"article","og_title":"SiteGround moves early to protect customers ahead of critical PHP security release","og_description":"Last updated: 22 October 2026, 12:00 UTC. PHP has released the fixes, and they\u2019re now applied across all SiteGround servers. PHP has announced two","og_url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/","og_site_name":"SiteGround","article_publisher":"https:\/\/www.facebook.com\/siteground","article_published_time":"2026-10-21T11:30:07+00:00","article_modified_time":"2026-10-22T11:39:31+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg","type":"image\/jpeg"}],"author":"Aleksandar Kolev","twitter_card":"summary_large_image","twitter_creator":"@siteground","twitter_site":"@siteground","twitter_misc":{"Written by":"Aleksandar Kolev","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#article","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/"},"author":{"name":"Aleksandar Kolev","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/cb7243a505466cc04641e011eb97c94d"},"headline":"SiteGround moves early to protect customers ahead of critical PHP security release","datePublished":"2026-10-21T11:30:07+00:00","dateModified":"2026-10-22T11:39:31+00:00","mainEntityOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/"},"wordCount":862,"commentCount":24,"publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg","keywords":["user-area-display"],"articleSection":["Product Updates","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/","url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/","name":"Critical PHP vulnerabilities: SiteGround sites protected","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg","datePublished":"2026-10-21T11:30:07+00:00","dateModified":"2026-10-22T11:39:31+00:00","description":"PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619. SiteGround protected all its servers before the release. No action needed.","breadcrumb":{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276"},{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245"},{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881"},{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305"},{"@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#primaryimage","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2026\/10\/php-security-header-2026.jpg","width":1200,"height":600,"caption":"Man working on a laptop with security graphics showing PHP protection, a blocked threat, and a software update."},{"@type":"BreadcrumbList","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/newblog.siteground.com\/en\/"},{"@type":"ListItem","position":2,"name":"SiteGround moves early to protect customers ahead of critical PHP security release"}]},{"@type":"WebSite","@id":"https:\/\/newblog.siteground.com\/en\/#website","url":"https:\/\/newblog.siteground.com\/en\/","name":"SiteGround Blog","description":"","publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/newblog.siteground.com\/en\/#organization","name":"SiteGround Blog","url":"https:\/\/newblog.siteground.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","width":1200,"height":400,"caption":"SiteGround Blog"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/siteground","https:\/\/x.com\/siteground","https:\/\/www.instagram.com\/siteground\/","https:\/\/www.youtube.com\/@siteground"]},{"@type":"Person","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/cb7243a505466cc04641e011eb97c94d","name":"Aleksandar Kolev","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e052d4b0a923379bef2baff3319f7dbe?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e052d4b0a923379bef2baff3319f7dbe?s=96&d=mm&r=g","caption":"Aleksandar Kolev"},"description":"Aleksandar focuses on how hosting infrastructure, performance systems, and platform tools work together to keep websites fast, secure, and reliable. His work translates complex hosting concepts, such as caching, DNS, and server-level optimization, into practical guidance based on real-world scenarios and user needs. Outside of work, he enjoys chess, meditation, playing guitar, and integrating AI systems in his daily life.","sameAs":["https:\/\/www.linkedin.com\/in\/aleksandar-kolev-a62172310\/"],"url":"https:\/\/newblog.siteground.com\/en\/author\/aleksandarkolev\/"},{"@type":"Question","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276","position":1,"url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581657276","name":"What are CVE-2026-109618 and CVE-2026-109619?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"They\u2019re two critical vulnerabilities in the PHP programming language, both rated 9.2 on the CVSS v4.0 scale. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245","position":2,"url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581665245","name":"Is my website on SiteGround affected?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"No action is needed. SiteGround has already put protective measures in place across all its servers, so sites hosted with us are covered at server level.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881","position":3,"url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581671881","name":"Do I need to update PHP or change my PHP version on SiteGround?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"No. SiteGround manages PHP at server level, so the protection applies to your site without any change on your end.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305","position":4,"url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581686305","name":"Are WordPress sites affected by PHP vulnerabilities?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"WordPress runs on PHP, so a flaw in PHP can affect WordPress sites regardless of which plugins or theme they use. On SiteGround, your WordPress site is already protected.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677","position":5,"url":"https:\/\/newblog.siteground.com\/en\/critical-php-vulnerabilities-october-2026\/#faq-question-1792581693677","name":"What should I do if my site is hosted elsewhere?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Check with your hosting provider, or upgrade PHP yourself as soon as fixed versions are available on php.net.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/26076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/users\/136"}],"replies":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/comments?post=26076"}],"version-history":[{"count":3,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/26076\/revisions"}],"predecessor-version":[{"id":26094,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/26076\/revisions\/26094"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/media\/26090"}],"wp:attachment":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/media?parent=26076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/categories?post=26076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/tags?post=26076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}