PHP Security Updates: What Sri Lankan Businesses Should Check Right Now
If your business website runs on PHP — and most do, including every WordPress, WooCommerce, Joomla, and Drupal site — the PHP engine itself occasionally needs security patches, separately from your theme or plugins. Here's a plain-English guide to checking whether you're exposed and what to do about it.
What was announced
The PHP project released security updates addressing CVE-2026-109618 and CVE-2026-109619, published on 21 October 2026. The issue affects all PHP installations serving web requests — including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. For the official details, see php.net.
Which versions are affected
Check your PHP branch against the fixed versions in the official advisory:
| PHP branch | Patched version |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
How to check your PHP version
On a server you control, run:
php -vImportant: the command-line version can differ from the version your website actually uses (PHP-FPM, Apache, containers, or managed hosting may each run a separate install). If you're on shared or managed hosting, ask your provider or check your hosting control panel (e.g. cPanel → "Select PHP Version").
How to update safely
- Back up your site and database first.
- Update to a version confirmed to contain the fix (see the table above).
- Restart or reload the relevant service (PHP-FPM, Apache) and confirm the live site reports the patched version.
- If you use Docker, update the PHP base image, rebuild, and redeploy.
- Test that your site still works — plugins and custom code occasionally need adjustment on a new PHP version.
"I just have a WordPress site — does this affect me?"
Possibly, yes. A vulnerability in the PHP runtime can affect any application running on it, even if WordPress, Laravel, or your plugins are fully up to date. Updating plugins is not a substitute for patching PHP itself. Check both.
Your quick checklist
- Find out which PHP version your website actually runs.
- Compare it with the patched versions in the official advisory.
- Back up, then update (or ask your host/developer to).
- Confirm the live site is on the patched version.
- Watch your logs for anything unusual.
The bottom line
Patching the software your website runs on is one of the simplest ways to reduce risk. If you manage your own servers, make this part of your routine maintenance; if a hosting provider or developer manages them for you, confirm with them that the update has been applied.
Disclaimer: This article is general cybersecurity guidance, not specific technical or legal advice. Always confirm vulnerability details, affected versions, and fixes against official PHP advisories and your software vendor before acting.