Are the PHP problems solved now, or not?

The PHP problems are keeping the web world busy: the patch for two critical flaws is out, but security experts claim that patch is incomplete. Dutch tech site Tweakers reported that they found a third bug. So, are the PHP problems solved now, or not? This article explains what is confirmed, what is still unverified, and why a managed platform like Base44 is a safer starting point for many businesses. The situation described is as of 22 October 2026 and can change quickly.

Table of contents

1. What happened with PHP?
2. Is it solved now?
3. Who is at risk?
4. What can you do now?
5. Base44 as a safe alternative
6. Frequently asked questions
7. Conclusion

What happened with PHP?

On Wednesday 21 October 2026 at 4:00 p.m., the PHP team released security updates for two critical vulnerabilities. They are CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. Both allow an attacker to execute code on a server without logging in. According to Security.NL, the issues involve memory corruption and a so-called stale global state that can lead to a use-after-free.

Websites went offline as a precaution

The impact was immediately visible. Security.NL reported that, following the disclosure, various government, hospital and media websites went offline as a precaution. Hosting and security companies did not wait for a confirmed attack. That shows how serious the flaws were considered to be.

Which versions are patched?

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official updates. For PHP 7.4, 8.0 and 8.1, the PHP team only published minimal source backports, which you have to compile into an update yourself. According to the team itself, the separate mitigations it lists do not make an installation secure.

Is it solved now?

The honest answer: the two known flaws are officially patched, but there is debate about what remains open afterwards. That difference matters for anyone deciding whether a system can go back online.

The claim of an incomplete patch

Tweakers wrote that security experts found a third bug and claim the patch is incomplete. According to TechPulse, researcher Nicolas Krassas reports that PHP 8.5.12 still leaves three possible attack routes open. That claim has not yet been independently confirmed. TechPulse also reports that he published his proof of concept without informing the PHP team beforehand.

What does the PHP team say?

Another researcher did report a memory bug in PHP 8.5.12 in a coordinated way. According to TechPulse, PHP core developer Ilija Tovilo calls it a simple memory bug that is much more complicated to exploit, and says it is unrelated to the two patched flaws. So there is no confirmed proof that the patch itself fails. There is also no reason to assume the matter is closed.

Why certainty is missing

Such a situation is typical. Details leaked early, attackers and researchers read along, and patches are written under time pressure. Assume that follow-up updates may come and keep your systems set up to receive them.

Who is at risk?

According to W3Techs, as cited by Security.NL, almost seventy percent of all websites run on PHP. Content management systems such as WordPress, Drupal, Joomla and Magento also depend on it. Any PHP installation that handles web requests is in principle vulnerable, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Outdated versions are the biggest problem

According to Security.NL, VirusTotal sees around 5.1 million IP addresses running PHP, a large share of which hide their version. Of the servers that do show their version, a good number run one that is no longer supported. If you do not know your PHP version, you cannot tell whether it is patched.

Dependent on your supplier

The Dutch NCSC points out that with many products, users depend on the vendor to update to the latest PHP version. A webshop with plugins, a third-party theme and a hosting package therefore means several parties that all have to update. You can read more about the link between technology and findability on our SEO page.

What can you do now?

Act quickly, but not blindly. The bodies cited by Security.NL advise making a risk assessment per system. The European CERT-EU recommends temporarily taking systems offline if they cannot be patched immediately.

• Find out which PHP version your hosting uses and update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• Running PHP 8.1 or older? Plan an upgrade, or ask your host about backported fixes.
• Ask your plugin, theme and hosting suppliers when they will patch.
• Check your log files for unusual requests.
• If a system cannot be patched quickly, take it offline temporarily.
• Follow the PHP release notes: a follow-up update cannot be ruled out.

Need help with the assessment? Take a look at our approach to web design and maintenance or contact us.

Base44 as a safe alternative

If you do not want to maintain your own PHP environment, there is an alternative. Base44, the AI platform from Wix, builds a complete website or web app from a description in plain language. Database, authentication and hosting are built into the platform. That means you do not have to patch PHP versions, server packages and plugins. FLOR-IT migrates clients to Base44, so that maintenance of the underlying technology lies with the platform. Our article on how Wix works tells you more about that ecosystem.

What changes for you?

Topic	Self-hosted PHP site	Base44
PHP updates	Your responsibility	Not applicable: no own PHP server
Hosting	Arrange it yourself	Built in
Authentication and database	Plugins or custom code	Built in
Plugin risk	High with outdated plugins	Much smaller
Design and SEO	Full control	Full control, with our guidance

To be honest: Base44 is not invulnerable either

Safe does not mean flawless. In July 2025, Wiz Research found an authentication flaw on Base44. Infosecurity Magazine reported that the flaw was patched within 24 hours and that there were no signs of abuse. The difference with the PHP situation: one party fixes it centrally, instead of thousands of separate servers that each have to update themselves. The configuration of your own app remains a point of attention, and we handle that together with you.

Frequently asked questions

1. Are the PHP problems solved now?

The two critical flaws CVE-2026-109618 and CVE-2026-109619 are officially patched. There are claims of additional attack routes, but these have not yet been independently confirmed.

2. Which PHP version should I install?

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Use the newest version your application supports.

3. What if I use PHP 8.1 or older?

Those versions no longer receive official updates. Plan an upgrade or ask your host about backported fixes.

4. Is my website affected if I use Wix or Base44?

On those platforms you do not manage your own PHP server. Always keep your own integrations and accounts in order, though.

5. Can I migrate my existing website to Base44?

Yes. We first take stock of content, SEO and integrations, so you do not lose your findability.

6. What does a migration cost?

That depends on size and features. In an introductory call we give a first indication.

Conclusion

Are the PHP problems solved now, or not? The two known flaws are patched, but the debate about a possibly incomplete patch is still going. So do not wait: update, check your suppliers and consider whether you still want to manage the technology yourself.

Want to know how secure your website is right now, or consider migrating to Base44? Book a free online meeting or read more about FLOR-IT. You can find more current articles in our news overview.

About the author

This article was written by Peter, Sales Director and owner of FLOR-IT. FLOR-IT is an Official Wix Enterprise Partner with more than 25 years of experience and over 1,500 websites delivered. We specialise in Wix Studio and Harmony, Base44, SEO and digital marketing, and work in Dutch, English, French and German.

Sources: Tweakers, Security.NL, TechPulse, PHP.net, Infosecurity Magazine.