PHP Patch Guide: Why Migrating to Base44 is the Lasting Fix

The patch for the two critical PHP flaws has been released. Read how to patch and restart, which long-term strategy works and when migrating to Base44 pays off.

The PHP patch for the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 is out. If your website runs on PHP, you need to patch and restart today. But that does not answer the bigger question: how do you make sure you are not in firefighting mode again next time? In this article you will read what has been released, how to apply the PHP patch safely, which long-term strategy works, and why migrating to Base44 is the lasting fix for many business owners.

The PHP patch is out: what was released?
Patching and restarting: the steps
When is patching not enough?
A long-term strategy
Why migrate to Base44 after all?
When migrating is not the best choice
How a migration works
Frequently asked questions
Conclusion

The PHP patch is out: what was released?

On 21 October 2026 the PHP security team released emergency updates for the supported PHP versions, following an announcement on php.net a day earlier. Both vulnerabilities score 9.2 out of 10 (CVSS v4.0) and, according to the available analyses, allow remote code execution without an attacker having to log in. In the worst case, an outsider can take over a web server.

In plain language: with CVE-2026-109618, PHP can be interrupted during a memory shortage while internal request data is only half set up, after which invalid data is treated as valid. With CVE-2026-109619, internal data remains after memory has been freed, so a later request on the same worker can abuse it. This is described in the Rescana analysis. The details are technical; what matters is the outcome.

These are the patched versions:

PHP branchFixed in

PHP 8.5

8.5.12

PHP 8.4

8.4.27

PHP 8.3

8.3.36

PHP 8.2

8.2.35

PHP 8.1 and older

No official fix

Researchers state that affected releases go back to PHP 5.4. That means old, forgotten websites can be vulnerable too.

What do we know about abuse?

The picture is mixed. Cloudflare says it has seen attack traffic, CERT-EU considers abuse likely because proof-of-concepts are circulating, while the PHP team had not found working exploits at release and CISA had not yet reported abuse. This can change quickly. Assume the risk is real.

Patching and restarting: the steps

An application update alone is not enough. The new PHP version has to be installed and the running processes have to be restarted. Here is how to go about it:

Take stock of all PHP environments. Think of live websites, test sites, containers, hosting panels and old projects.
Check the version. Run php -v or ask your host, and compare with the table above.
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Restart everything that runs PHP: Apache, PHP-FPM and long-running processes such as queue workers.
Check the version again, including PHP-FPM itself.
Look for signs of abuse. Suspicious signs include unusually large PHPSESSID cookies, multipart requests followed by memory errors, unexplained worker crashes and unknown PHP files. A clean result does not prove you were not hit.

Is your site with a host? Ask in writing which PHP version your site runs and when it was restarted. Note that on some server setups PHP updates are not included in the regular security updates. Laravel Forge, for example, warns that users must update PHP themselves there.

When is patching not enough?

There is no official fix for PHP 8.1 and older. PHP has published minimal source backports for 7.4, 8.0 and 8.1, meant for those who compile themselves, and some vendors offer their own backports. CISA advises taking systems running PHP 8.1 or older offline until they are patched. You then have three options: upgrade to a supported version (and test whether your plug-ins still work), bring in a vendor with long-term support, or take the site offline temporarily.

PHP also lists temporary measures, such as limiting upload sizes and switching off session.upload_progress.enabled. The PHP team itself says these do not make an installation safe. Treat them as an emergency brake, not a solution.

Also watch the next date: according to Rescana, support for PHP 8.2 ends on 31 December 2026. A site patched to 8.2.35 today will therefore be on an unsupported version again in about ten weeks. Patching buys time, but it does not solve the underlying problem.

A long-term strategy

This PHP flaw is not the first and will not be the last. Anyone with a PHP website is responsible for the servers beneath it. A lasting approach has five parts.

1. Know what you have

Make an overview of all your websites: where they run, which PHP version, who administers them, which plug-ins they use and when they were last updated. You cannot patch what you do not know. Forgotten test sites and old campaign pages are often the weakest point.

2. Make patching a fixed rhythm

Agree on how quickly you apply critical updates, for example within 24 to 72 hours, and who does it. Follow announcements from PHP and from security agencies, and include restarting processes in your procedure.

3. Run only supported versions

Put the end-of-support date of your PHP version in the calendar, well ahead of time. A version without support gets no fix at the next flaw.

4. Limit the damage if things go wrong

Use a web application firewall (WAF), keep backups outside the server, give processes and users as few rights as possible and keep a test environment. A WAF can offer some protection, but patching remains necessary.

5. Choose per website: update, modernise or migrate

Not every website needs the same solution. This table helps you choose:

Type of websiteAdvice

Business website, blog or portfolio on WordPress

Migrate to Base44 (or Wix), so there is no server left to manage

Large content site with an editorial team

Migrate with a careful redirect plan to keep your Google rankings

Web shop with many integrations

Assess case by case; first move to a supported PHP version, then decide

Custom PHP application

Modernise on a supported version with professional maintenance

Old test or campaign site

Take it offline

Why migrate to Base44 after all?

Patching is a treadmill: every critical PHP flaw means new work for everyone with a PHP site. The core of the problem is not this one flaw, but that as a website owner you are responsible for the layer beneath it. With Base44, that layer is part of the platform.

No server to patch. Hosting and underlying software are part of the platform. As far as we know, Base44 does not use PHP, so this specific flaw does not affect a Base44 website.
Fewer components that can go out of date. No loose plug-ins and themes that each have their own update cycle.
Security features built in. According to Base44's documentation, you can set per data type who may view and edit data, and keys and credentials are kept in an encrypted store.
Quick to move. A simple business website can in many cases be moved technically within a few hours. Building and adjusting is done with AI, under the control of an experienced team.
One point of contact. We handle the migration, the redirects and the maintenance, so you can focus on your business.

AspectWebsite on PHPWebsite on Base44

Server updates

You or your host

The platform

Plug-ins and themes

Keep track and test yourself

No separate plug-ins to update

Response to a new critical PHP flaw

Patch, restart, check

Not affected via PHP

End of support for a version

You must upgrade in time

Handled by the platform

Ongoing maintenance load

High

Low

An honest caveat: no platform is risk-free. Weak passwords, phishing and too many people with admin rights remain a risk on Base44 too. Always keep strong passwords and controlled access in order.

When migrating is not the best choice

Migrating is not the best route for every website. If you have a custom PHP application, a web shop with many integrations to accounting or warehouse systems, or an editorial team that relies heavily on specific WordPress plug-ins, modernising and professional maintenance on a supported PHP version is often wiser. Also read our explanation of Base44 for businesses and when not to use it. With any switch, ask how ownership and export of your data work, so you are not locked in to a single vendor.

How a migration works

30-minute intro call. We look at your current website and tell you honestly whether migrating fits.
Inventory. We record pages, texts, forms and integrations.
New build on Base44, matching what your website needs to do.
Redirects and testing. Every old address points to the right new page, so your findability is kept.
Going live without your website going down.

You can read more about the approach in our article on website migration in 2026. Also see our services and pricing, and our earlier explanation of the PHP flaw and Wix websites.

Frequently asked questions

Is patching enough to be safe?

Patching and restarting is the minimum. Afterwards you need to check for signs of abuse, because an attacker may already have been in. For the longer term you also need a fixed patch rhythm and a supported PHP version.

What should I do if my host runs PHP 8.1 or older?

There is no official fix for those versions. Ask your host about an upgrade to a supported version or about their own backport, and consider taking the site offline or putting it behind a firewall until then.

How do I know whether my website has been hacked?

Watch for unusually large PHPSESSID cookies, unknown PHP files, unexplained crashes and sudden slowness. A clean result does not prove you were not hit. If in doubt, have a specialist take a look.

Does this flaw also affect Base44 websites?

As far as we know, Base44 does not use PHP, so this specific flaw does not affect a Base44 website. That does not mean a website can never be vulnerable; access control and passwords remain important.

How long does a migration to Base44 take?

A simple business website is often moved technically in a few hours. Larger sites and web shops take more time. After a short intro call we give you a concrete estimate.

Will I lose my Google rankings if I migrate?

Not if the migration is done well. With an overview of your current addresses and redirects, your rankings are kept as far as possible. That is always a fixed part of our approach.

Conclusion

The PHP patch is here, and anyone running PHP needs to patch, restart and check today. But the patch does not solve the fact that you face the same work again with every next flaw. With a good inventory, a fixed patch rhythm and supported versions you can keep a PHP site in order. If you no longer want to carry that work yourself, migrating to Base44 is the lasting fix for many websites.

With more than twenty years of experience and over 1,500 websites delivered, we are happy to help. Book a free 30-minute intro call and we will tell you honestly what works best for your website. Read more about us, browse our other articles or get in touch.

Sources

Updated on 22 October 2026. The picture on abuse and affected versions may still change.

PHP patch is out: how to handle it, and why migrating to Base44 is the lasting fix

Table of contents