What is PHP, in plain English?

PHP is the kitchen behind a website. When you open a page, PHP takes the request, collects the text and pictures from storage and sends back a finished page to your browser. WordPress, Drupal, Joomla and a great many online shops are built with it, which is why so many sites are involved.

What does remote code execution mean for my website?

It means a stranger can make your server carry out their instructions without knowing any password. They can change what visitors see, take what is stored on the site, send mail in your name or leave something behind that stays. That is a different and worse problem than the site simply going offline.

What should I ask my hosting provider about the October 2026 PHP flaw?

Ask three questions and insist on a number in the answer: which PHP version my site runs today, whether it includes the fixes released on 21 October 2026, and when it will be updated if not. Safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP 8.1 or older needs moving entirely.

What Is the PHP Vulnerability? Explained Without the Jargon

October 22, 2026 3 min read

Dark banner reading 'You don't run PHP. Your website does.' beside three stacked cards: the page people see, the PHP that builds it, the server it sits on

Think of your website as a restaurant. The page you see is the dining room, and PHP is the kitchen behind it: every time someone opens your site, PHP cooks the page to order and sends it out. In October, security researchers found that this particular kitchen could be made to follow instructions shouted through the back door by somebody who never walked in the front. That is the whole story, and it is the reason your host has been sending you emails.

What was found, and why it matters to you

Two flaws, named CVE-2026-109618 and CVE-2026-109619, allow what the industry calls remote code execution. Translated: a stranger on the internet can make your server run their commands, with no password and no login. They can rewrite what your visitors see, take what is stored, send messages that appear to come from you, or settle in quietly.

The repaired versions came out on 21 October. They are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If the number for your site is lower than the one for its branch, the kitchen door is still open. If your site runs PHP 8.1 or older, there is no repair coming for that version at all, and it needs to move to a newer one.

You do not need to understand the flaw. You need to know your version number and who is responsible for changing it.

What to do today, without touching anything technical

If a hosting company or a developer looks after your site, write to them and ask three things: which PHP version runs it right now, whether that version includes the 21 October fixes, and when they will update it. Ask for the number itself. An answer that only says everything is fine is not an answer you can check.

If you manage a WordPress site yourself, the version is in your dashboard under Tools and then Site Health. Updates should only ever come from php.net, your server’s own software repositories, or your hosting provider. Not from an email, and not from a stranger offering a tool.

For whoever has server access

Your developer or host can run this. It reads the machine and reports; it asks for nothing:

curl -fsSL https://blog.limewire.com/content/files/2026/10/php-exposure-check.txt -o php-exposure-check.sh
less php-exposure-check.sh
sh php-exposure-check.sh

The file’s SHA-256 fingerprint: c13cd5690c9d352c6a95e854602be2f330a0799435c05a8261037401fcf50255. When it ends with 0, everything it found is already fixed. A 1 means something is vulnerable or too old to be fixed. A 2 means it found no PHP on that machine. The identical file is also available through LimeWire, posted by our verified @limewireofficial account, free to download without an account and with no expiry date.

If you want the technical version, or you are forwarding this to the person who maintains your site, send them our detailed article on these vulnerabilities, which covers every platform and version properly.

One honest note. We had nothing to do with this PHP problem, and our interest is slightly sentimental. In the early 2000s, LimeWire was how a whole generation discovered that a file’s name is just a label somebody typed, and the song you asked for was not always the song that arrived. We have changed careers since then, but the lesson stuck.