# PHP Security Update: What Tourism Businesses Should Do

> PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws (CVE-2026-109618/109619). A plain checklist for hotels, tours and travel sites.

Canonical: https://njoy.consulting/articles/php-security-update-cve-2026-109618-tourism
Last updated: 2026-10-21

Published 21 October 2026 Updated 21 October 2026, after the PHP patch release and Google’s downtime guidance 8 min read Nathan James

PHP security update CVE-2026-109618 and CVE-2026-109619 ("php2shell"): if a hotel, tour or travel website runs on WordPress or other PHP software, it needs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

**Update:** The PHP project released the fixes on the afternoon of 21 October 2026, at around 15:00 BST, following its advance warning on 20 October. The two CVE numbers, the fixed version numbers, the NCSC’s updated advice and the checklist below reflect the patch release. Advice from Google on taking a site offline safely during patching was added in the evening.

**TL;DR:** Two critical security flaws in PHP, the language that powers WordPress and a large share of hotel, tour operator and travel websites, could let an attacker take control of a web server without needing a password. Both are rated 9.2 out of 10 for severity. The PHP project released fixed versions on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and the UK National Cyber Security Centre is urging organisations to update immediately. Most small tourism businesses do not need to touch any code: the job is to ask the hosting provider or web developer which PHP version the site runs, confirm it has been updated today, take a fresh backup, update WordPress and its plugins, and keep an eye out for anything unusual on the site.

![Close-up of a finger pressing a key on a laptop keyboard](https://njoy.consulting/php-security-update-keyboard.webp)

## What happened, in plain words

PHP is the software that runs behind the scenes on a huge number of websites. When a guest opens a booking page, fills in an enquiry form or reads a blog post on a WordPress site, PHP is usually doing the work on the server.

On 20 October 2026 the PHP security team gave advance notice that an urgent fix for two critical problems was coming the next day. On 21 October it released that fix and published the details.

In simple terms, both problems are about how PHP tidies up after itself:

- **CVE-2026-109618 ("RCE via OOM corruption").** When a request uses up its memory allowance at exactly the wrong moment, PHP can leave half-finished data behind and then treat it as valid. A specially crafted request, such as an oversized form or file upload, can use this to corrupt memory.
- **CVE-2026-109619 ("RCE via stale global state").** After certain errors, PHP can keep hold of information from one visitor’s request after that memory has been cleared. The next request handled by the same part of the server can then pick up that leftover data.

In both cases the worst outcome is "remote code execution": an attacker on the internet runs their own commands on the web server, with no login needed. On one common setup (Apache with mod\_php), the PHP team showed this can happen before the website’s own code even starts, so a well-built website does not protect itself.

The two flaws have been nicknamed "php2shell" in security alerts.

**Is it being exploited?** At the time of the patch, the US Cybersecurity and Infrastructure Security Agency (CISA) said it had not yet seen attacks using these flaws. The EU’s CERT-EU said early proof-of-concept code was already circulating, which makes attacks more likely soon. The safe assumption is that unpatched sites will be targeted.

## Who is affected

Any website or system where PHP serves web pages is in scope. That includes:

- WordPress, WooCommerce, Drupal and Joomla sites
- Booking engines, enquiry forms and travel blogs built on PHP
- Common server setups, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed (the PHP team rates Apache with mod\_php as the highest risk)
- Other products that quietly include PHP inside them. The Dutch NCSC keeps a [list of affected third-party software](https://github.com/NCSC-NL/php2shell)

Affected versions are all PHP 8.2 releases before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27 and PHP 8.5 before 8.5.12. PHP 8.1 and older no longer receive fixes from the PHP project and should be treated as vulnerable.

For a typical tourism business, this covers the main website, a separate blog, a staging copy of the site, and any old microsites or campaign pages still online.

## What the patch fixes

The PHP project released four security updates on 21 October 2026:

| PHP branch | Fixed version |
| --- | --- |
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |

These versions change how PHP handles running out of memory, so it no longer leaves broken data behind, and make sure leftover data from one request is properly cleared before the next one starts.

A few points worth knowing:

- **Updating is the only complete fix.** The PHP team has published temporary settings that reduce some of the risk, but says they "do not make an installation safe".
- **Linux distributions and long-term support vendors got the fixes in advance**, so most good hosting companies can roll them out quickly.
- **PHP 8.1, 8.0 and 7.4 are end of life.** Because of the severity, the PHP team published minimal source fixes for these older versions, but the real answer is to move to a supported version.
- **PHP 8.2 reaches end of life on 31 December 2026**, so a site on 8.2 should plan its next upgrade now.

The current list of supported versions is on the [PHP supported versions page](https://www.php.net/supported-versions.php).

## What tourism businesses should do

Most hotels, guesthouses, tour operators and travel publishers use shared or managed hosting, so the hosting company or web developer does the technical work. The checklist below is about asking the right questions and covering the basics.

1. **Find out which PHP version the site runs.** In WordPress, go to Tools, then Site Health, then the Info tab, and open the "Server" section. The hosting control panel (for example cPanel or Plesk) usually shows it too. Or simply ask the host or developer.
2. **Ask the hosting provider to confirm the update.** A short message works: "Has PHP on my hosting been updated to a version that fixes CVE-2026-109618 and CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the vendor’s patched package)? If not, when will it be?" Get the answer in writing.
3. **If the site runs on its own server or VPS**, the update needs to be installed by whoever manages that server. Ask the developer or IT provider to do it today and restart PHP afterwards.
4. **Take a fresh backup first.** Make sure there is a recent copy of the website files and database stored somewhere other than the web server, and check it can actually be restored.
5. **Update WordPress, themes and plugins.** This does not fix the PHP flaw itself, but it closes other doors attackers often try at the same time. Remove plugins and themes that are no longer used. WordPress has a guide to [updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/).
6. **Move off unsupported PHP.** If the site is on PHP 8.1 or older, ask the host or developer to move it to a supported version. Check the [PHP supported versions page](https://www.php.net/supported-versions.php) and the [WordPress requirements](https://wordpress.org/about/requirements/). Test on a staging copy first if possible.
7. **Look for signs of trouble.** Warning signs include new administrator accounts nobody created, unexpected redirects to other websites, strange pages appearing in Google, the site suddenly slowing down, unknown files in the hosting account, or a warning from the host or Google. If anything looks wrong, tell the host straight away.
8. **Change passwords if there is any doubt.** This means the hosting account, WordPress admin and database passwords, and turning on two-factor sign-in wherever it is offered.
9. **Remember the other places PHP may be hiding.** This includes old campaign sites, a staging site, a separate blog, or a third-party booking or CRM tool that runs on PHP. Ask each supplier whether they are affected and have updated.

If a site cannot be updated quickly, the UK NCSC advice is to consider taking it offline until it can be fixed.

### Taking a site offline without hurting Google rankings

On 21 October, Google Search Central reminded site owners that taking a site offline to patch PHP should be done with a "503 Service Unavailable" response, which tells search engines the outage is temporary. Google says this keeps pages that are already indexed in search while the work is done, and that rankings return to normal once the site is back.

In plain terms:

- **Ask the host or developer to show a 503 maintenance page**, not a blank page, a "page not found" (404) error, or a normal-looking page that just says the site is down.
- **The 503 needs to come from outside PHP**, because PHP is the thing being fixed. Common options are a rule at the CDN (for example Cloudflare), a host’s maintenance mode, or temporarily pointing the domain at a simple holding server.
- **Keep robots.txt working normally.** Google says robots.txt should not return a 503, as that stops all crawling.
- **Keep it short.** Google advises against serving a 503 for more than one to two days, as pages may start dropping out of search. For a longer closure, Google suggests a simple holding home page instead.
- **Optionally add a "Retry-After" header**, which tells search engines when to check back.

Sources: [Search Engine Journal report on Google’s 503 reminder](https://www.searchenginejournal.com/google-reminds-sites-to-serve-503s-during-server-downtime/593873/), [Google: how HTTP status codes affect Google’s crawlers](https://developers.google.com/crawling/docs/troubleshooting/http-status-codes), [Google: pausing or disabling a website](https://developers.google.com/search/docs/crawling-indexing/pause-online-business).

## Where to get advice and help

- **Your hosting provider’s support team.** This is the fastest route for most small businesses. Many hosts publish status updates when a major patch like this lands.
- **UK National Cyber Security Centre alert.** The [NCSC alert on the PHP security issue](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) sets out the priority actions in plain language.
- **NCSC Small Business Guide.** The [Small Business Guide](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security) covers backups, updates, passwords and avoiding common attacks.
- **Cyber Essentials.** [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) is a UK government-backed scheme that sets out basic security controls, including keeping software up to date.
- **NCSC Early Warning.** The free [Early Warning service](https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning) notifies UK organisations of potential threats on their networks.
- **Reporting an incident.** If a business has been hacked or defrauded, it can report it to [Action Fraud](https://www.reportfraud.police.uk/) (England, Wales and Northern Ireland; Police Scotland handles reports in Scotland) and to the NCSC through its [incident reporting service](https://report.ncsc.gov.uk/). For hands-on help, the NCSC lists [assured Cyber Incident Response providers](https://www.ncsc.gov.uk/schemes/cyber-incident-response/introduction).
- **PHP’s own security information.** The [official PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and the [PHP security manual](https://www.php.net/manual/en/security.php) are the primary sources.
- **WordPress hardening.** WordPress publishes a guide to [hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/) for site owners and developers.

## Frequently asked questions

Does this affect a website built on Wix, Squarespace or Shopify?

These platforms manage their own servers, so site owners cannot and do not need to update PHP themselves. Any update is the platform’s job. The risk sits mainly with self-hosted WordPress, Drupal, Joomla and other PHP sites.

The site is on WordPress with managed hosting. Is it already safe?

Probably soon, if not already, but it is worth confirming. Ask the host which PHP version the site is on and whether it includes the 21 October fix. Do not assume.

Will updating PHP break the website?

A security update within the same branch (for example 8.3.x to 8.3.36) rarely causes problems. Moving from an old version such as PHP 7.4 to PHP 8.3 is a bigger change and is best tested on a staging copy first, with a backup in place.

Do guests’ card details or booking data need to be reported?

Only if there is evidence of a breach. If personal data may have been accessed, UK businesses may need to report it to the Information Commissioner’s Office within 72 hours. Getting advice early from the host or an incident response provider helps.

Will taking the site offline to patch it hurt Google rankings?

A short outage served as a 503 "Service Unavailable" page should not, according to Google. Problems start if the site shows errors or blank pages, or stays down for more than a day or two.

## Sources

- [PHP.net, security advisory and release announcements, 21 October 2026](https://www.php.net/archive/2026.php#2026-10-21-5)
- [PHP.net, advance notice of upcoming critical security release, 20 October 2026](https://www.php.net/archive/2026.php#2026-10-20-1)
- [PHP announce list, PHP 8.3.36 released, 21 October 2026](https://news-web.php.net/php.announce/511)
- [GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [oss-security disclosure, CVE-2026-109618, 21 October 2026](https://www.openwall.com/lists/oss-security/2026/10/21/6)
- [The PHP Foundation, "Today’s PHP Security Release", 21 October 2026](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)
- [UK NCSC, "Critical security issue affecting PHP", 21 October 2026](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)
- [CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 October 2026](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)
- [CERT-EU, Security Advisory 2026-018, 21 October 2026](https://cert.europa.eu/publications/security-advisories/2026-018)
- [NHS England Digital, cyber alert CC-4875](https://digital.nhs.uk/cyber-alerts/2026/cc-4875)
- [NCSC-NL, php2shell affected software list](https://github.com/NCSC-NL/php2shell)
- [PHP supported versions](https://www.php.net/supported-versions.php)
- [Travel Massive discussion, 21 October 2026](https://www.travelmassive.com/posts/anyone-with-a-blog-or-website-running-on-php-needs-to-urgently-upgrade-now-525464396)
- [Search Engine Journal, "Google Reminds Sites To Serve A 503 During PHP Patch Downtime", 21 October 2026](https://www.searchenginejournal.com/google-reminds-sites-to-serve-503s-during-server-downtime/593873/)
- [Google Crawling Infrastructure, "How HTTP Status Codes Affect Google’s Crawlers"](https://developers.google.com/crawling/docs/troubleshooting/http-status-codes)
- [Google Search Central, "Temporarily Pause or Disable a Website"](https://developers.google.com/search/docs/crawling-indexing/pause-online-business)

![Nathan James](https://njoy.consulting/nathan-james.webp)

Nathan James

Travel and Tourism SEO Consultant, NJoy Consulting

Nathan James is a digital strategy and SEO consultant specialising in travel and tourism brands across Southeast Asia and Europe.

[Connect on LinkedIn](https://www.linkedin.com/in/nathanjamesnjoy/)

## Related articles

- [Airbnb SEO Ranking Factors: What the Data and Airbnb Actually Say](https://njoy.consulting/articles/airbnb-seo-ranking-factors): Short-Term Rentals October 15, 2026 8 min What Airbnb's own help pages say about search ranking: quality, popularity, price and location, plus a simple data loop for fixing one weak signal at a time.
- [Nomads.com's AI Agent API and MCP: Your Next Customer Won't Visit Your Website](https://njoy.consulting/articles/ai-agents-travel-nomads-api): Travel Tech October 13, 2026 10 min Nomads.com's new API is built for AI agents first, humans second. Here is what agentic travel means for DMOs, hotels and tour operators, and how to get ready.
- [September 2026 Travel Tech Recap: AI Across the Guest Journey](https://njoy.consulting/articles/september-travel-tech): Hospitality Technology October 4, 2026 11 min Google, Accor, Agoda and Thailand's THIM show how technology is connecting discovery, booking, arrival and guest service, with practical actions for tourism businesses.

[All articles](https://njoy.consulting/articles)