PHP Security Alert: How to Find Vulnerable Servers and Protect Your Website

The reported PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619 highlight the importance of keeping server software updated and knowing exactly what is running across your infrastructure. Businesses using WordPress, Magento, Laravel, Drupal, or custom PHP applications should remember that website security involves more than updating application code.

What Is the PHP Security Vulnerability?

PHP is a server-side programming language used to build dynamic websites and web applications. According to the supplied advisory, CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in the PHP runtime, each assigned a CVSS score of 9.2.

The reported risks include:

• Remote code execution: An attacker may be able to execute code on a vulnerable server without first authenticating.
• Sensitive information exposure: Memory leaks may expose data handled by other requests, potentially including passwords, authentication tokens, and API keys.
• Broader infrastructure risk: A vulnerable PHP installation may affect multiple applications or administrative services hosted on the same system.

A runtime vulnerability is not limited to one application. If several applications rely on an affected PHP installation, each may require investigation.

Which Websites and Applications Could Be Affected?

Any application running on an affected PHP runtime may require attention. The risk is not restricted to a particular framework or content management system.

Other services, including database administration tools, mail platforms, monitoring systems, billing applications, and file-sharing solutions, may also use PHP. A forgotten administration panel or older internal application can create risk even when the main company website is updated.

Why Finding Every PHP Installation Is Difficult

1. Multiple applications share the same server

A single VPS or dedicated server may host several websites and internal tools. Updating one application does not necessarily update the PHP runtime used by the others.

2. Administrative services use different ports

Hosting panels and administrative interfaces may use ports other than standard HTTP and HTTPS. A basic check of ports 80 and 443 may miss exposed services.

3. PHP applications can run under hidden paths

A domain might serve a normal website at its homepage while exposing additional applications under paths such as /phpmyadmin/, /webmail/, or other administrative routes.

4. PHP version information may not be visible

Some servers hide PHP version information in HTTP headers. Proxies, CDNs, and security configurations may also remove identifying headers. The absence of a visible PHP version does not prove that a server is safe.

5. Containers can preserve old software

A Docker image built using an older PHP base image can retain that version until the image is rebuilt or replaced with an appropriately updated image. Updating the host operating system alone may not fix PHP inside a running container.

6. Old domains and test environments are overlooked

Staging websites, temporary campaign pages, acquired domains, development servers, and applications maintained by external agencies can fall outside the normal infrastructure inventory.

How to Find and Fix Vulnerable PHP Installations

Step 1: Build a complete asset inventory

List all infrastructure your organisation owns or manages, including:

• Production websites, online stores, and subdomains.
• Development and staging environments.
• Public server IP addresses and cloud-hosted systems.
• Hosting control panels and administrative services.
• Docker containers and application deployment environments.
• Websites managed by external development agencies.

Keep this inventory centrally so updates and future security reviews can be tracked consistently.

Step 2: Identify exposed web services

Review internet-accessible services, including those running on non-standard ports. Tools such as Subfinder, DNSx, Naabu, and HTTPx can help authorised security teams discover domains, resolve hosts, identify open ports, and examine HTTP services.

httpx -l hosts.txt -silent -o web-services.txt

This example assumes hosts.txt contains valid targets and HTTPx is installed. Service discovery is only an initial step; it does not guarantee that every application or PHP installation has been identified.

Important: Run discovery and scanning tools only against systems you own or have explicit permission to assess.

Step 3: Identify services that use PHP

Review HTTP responses, application fingerprints, server configuration, and known application paths. Potential indicators include PHP-related response headers, PHP session cookies, application fingerprints, hosting configuration, installed packages, and running processes.

Treat these indicators as clues rather than definitive proof. For internal infrastructure, inspecting the actual server configuration is generally more reliable than relying only on external scans.

Step 4: Verify the installed PHP version

On Linux servers, administrators can begin with commands such as:

php -v
php-fpm -v

The second command applies where PHP-FPM is installed and available under that command name. For Debian or Ubuntu systems, inspect installed packages with:

dpkg -l 'php*' | grep '^ii'

For RHEL-based systems, use:

rpm -qa 'php*'

Also inspect running processes, web-server modules, containers, and application-specific runtimes. A server may have multiple PHP versions installed, and the command-line version may differ from the version serving a website.

Step 5: Install the appropriate security update

Use the official PHP advisory and your operating system or hosting provider's security guidance to determine the correct fix. The supplied advisory lists these first fixed releases:

For unsupported PHP branches, plan a move to a supported version or use a vendor security patch that has been explicitly confirmed to address the issue.

Step 6: Restart services and verify the fix

Installing an updated package does not necessarily replace code already loaded into a running process. Depending on the deployment, remediation may require restarting PHP-FPM, Apache, LiteSpeed, or another relevant service. Containers may need to be rebuilt and redeployed.

1. Confirm that the expected package or image is installed.
2. Restart affected processes using the appropriate maintenance procedure.
3. Check the running runtime and application configuration.
4. Test the website and its critical functions.
5. Verify the fix through the normal production access path.
6. Record the update and any remaining exceptions.

What If You Cannot Patch Immediately?

If a PHP installation is confirmed to be vulnerable and an immediate update is not possible, do not assume it is safe simply because no suspicious activity has been observed.

• Restrict public access to the affected service.
• Disable or isolate vulnerable administrative interfaces where feasible.
• Apply appropriate vendor-recommended mitigations.
• Review firewall rules and network access controls.
• Prioritise exposed services that handle sensitive information.
• Schedule the permanent fix as soon as a verified package becomes available.

Temporary configuration changes may reduce exposure, but they should not be treated as substitutes for a security update unless the vendor confirms that they fully address the issue.

What Should You Do If Your Server Was Exposed?

If an affected server was accessible from the internet before remediation, investigate whether sensitive information or systems may have been compromised.

1. Review logs and system activity. Look for unusual requests, unexpected processes, unauthorised file changes, suspicious accounts, and unexpected outbound connections.
2. Rotate potentially exposed secrets. Depending on the investigation, this may include database credentials, API keys, session-signing keys, and other authentication secrets.
3. Inspect connected services. Determine whether the server could access customer databases, cloud resources, email systems, or other internal services.
4. Preserve evidence. Retain relevant logs and system information before making changes that could destroy useful evidence.
5. Escalate when necessary. If unauthorised access is suspected, involve a qualified security professional and follow your incident-response process.

Patching closes the known software vulnerability, but it does not automatically remove an attacker's access if the system was already compromised.

How Website Owners Can Improve PHP Security

Maintain an accurate software inventory

Track PHP versions, operating systems, web servers, frameworks, plugins, containers, and hosting control panels. Assign responsibility for each system.

Automate update monitoring

Use package-management tools, vulnerability scanners, and dependency monitoring to identify outdated components before they become urgent problems.

Reduce unnecessary public exposure

Administrative panels and internal tools should not be publicly accessible unless there is a clear operational requirement and appropriate access protection.

Review container images regularly

Keep base images updated, rebuild images when security fixes are released, and redeploy through a controlled process.

Schedule security assessments

Regularly review exposed services, configuration weaknesses, outdated dependencies, access permissions, and backup procedures.

Prepare for security incidents

Maintain tested backups, document recovery procedures, and establish a process for investigating suspicious activity and rotating credentials.

How InfoCaptia Can Help

Website security is an ongoing responsibility, particularly for businesses that depend on online stores, customer portals, custom applications, and cloud infrastructure.

InfoCaptia helps businesses strengthen their digital presence through web development, technical maintenance, and AI-powered digital solutions. Keeping software dependencies current and maintaining a clear view of application infrastructure are important parts of a reliable online operation.

If your business manages PHP-based websites or applications, consider reviewing your server inventory, update process, and security monitoring procedures.

Frequently Asked Questions

Does this PHP vulnerability affect WordPress websites?

A WordPress website may be at risk if it uses an affected PHP runtime. Updating WordPress alone does not necessarily fix a vulnerability in the underlying PHP installation. Verify the runtime and applicable security update.

Does updating PHP automatically fix every application?

Not always. Applications may depend on particular PHP versions or extensions. Test compatibility, update the appropriate packages, restart required services, and verify that applications work correctly after remediation.

Can a PHP version be vulnerable even if it is hidden from visitors?

Yes. Hiding PHP version information in HTTP headers can reduce unnecessary information disclosure, but it does not patch a vulnerable runtime.

Are Docker-based applications protected by updating the host server?

Not necessarily. Containers can include their own PHP runtime. Inspect the container image and running application, rebuild with an appropriate updated base image, and redeploy where required.

Is restarting PHP necessary after installing an update?

It may be. Running processes can continue using code loaded before the package update. Follow package and service-specific instructions, then verify that the updated runtime is running.

What is the most important first step?

Identify potentially affected PHP installations, verify their versions and vendor advisories, and prioritise exposed systems for remediation. An accurate inventory makes it easier to ensure that important services are not missed.

Final Thoughts

Securing a website requires more than maintaining its visible pages. The underlying software, hosting environment, containers, administrative services, and connected systems all contribute to application security.

By maintaining an accurate asset inventory, applying verified updates, restarting affected processes, and investigating possible exposure, organisations can respond more effectively to serious PHP security issues.

InfoCaptia recommends making infrastructure maintenance and security verification part of your regular website management process—not just an emergency response when a vulnerability becomes public.