PHP VULNERABILITIES · OCTOBER 2026
Ask your AI if your site is safe.
In October 2026 the PHP team announced three vulnerabilities in PHP. WordPress, WooCommerce, Joomla, Drupal and Magento all run on PHP. Two of the vulnerabilities let an attacker run code, without logging in, on a server that has not been updated.
You don't need to be technical to check whether you're at risk. Copy the prompt below and paste it into ChatGPT, Claude or Gemini. Your AI walks you through it, right up to an email for your hosting company.
THE PROMPT
I want to know whether my website is safe from the October 2026 PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560). The PHP team announced the first two on php.net on 21 October 2026 and the third on 23 October 2026. There is no public CVE record for the third yet; if you can't find it, go by the php.net announcement.
Step 1: Look at https://builtwith.com/[MYDOMAIN] and tell me whether my website runs on PHP. Also look for WordPress, WooCommerce, Joomla, Drupal or Magento, because those always run on PHP. If you can't open that page, say so and ask me to open it and tell you what I see. If you see no PHP there, that doesn't prove my site doesn't use it: say it's uncertain and include the question in the email from step 4.
Step 2: If my site runs on PHP, explain in plain language how I find my PHP version. For WordPress: Tools, Site Health, Info, then the Server section (the PHP version line).
Step 3: Compare my version with the safe version for the same series: 8.5.12 or higher for 8.5, 8.4.27 or higher for 8.4, 8.3.36 or higher for 8.3, 8.2.35 or higher for 8.2. Each series has its own minimum, so 8.3.35 is not safe even though it is a higher number than 8.2.35. PHP 8.1 and older no longer get updates from the PHP team itself. Give me two separate answers. One: am I safe from the first two vulnerabilities, or do I need to update? Some hosting companies put the fix into an older version, so a lower number doesn't always mean I'm unsafe; if in doubt, say so. Two: there is no update for the third vulnerability yet, so don't tell me I'm safe from it. I only know that once my hosting company confirms the setting from step 4 is set to 0.
Step 4: Write a short email I can send to my hosting company, asking whether the patch has been applied and whether session.upload_progress.enabled is set to 0 against the third vulnerability. Mention that the PHP team recommended that setting on 23 October 2026 until the next regular PHP release.
Use simple language. I'm not technical.
HOW TO USE IT
- Fill in your domain. It goes into the right place in the prompt.
- Click Copy the prompt and paste it into a new chat with ChatGPT, Claude or Gemini.
- Answer your AI's questions. At the end you have an email ready to send to your hosting company.
GOOD TO KNOW
- For the first two vulnerabilities, only a PHP update really helps. For the third, the PHP team recommends the setting from step 4 until the next regular PHP release.
- PHP 8.2 gets security updates until 31 December 2026. PHP 8.1 and older no longer get any from the PHP team.
- An AI can be wrong. If you want certainty, check with your hosting company.
Security announcements from the PHP team (php.net)CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)
Last checked on 26 October 2026.