# PHP security update: client notice and 5-step checklist

Free from Kitwise Studio (kitwisestudio.com/free). A template, not security or legal advice.

## What happened
On Oct 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). The PHP Foundation says they "allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now."
Source: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Security firm Wiz, which worked on the research with Calif, says applying the PHP update "remains the only complete remediation." Source: https://www.wiz.io/blog/php2shell-php-rce
This page does not say whether older versions such as PHP 8.1 have a fix. Check with your host or the PHP project.

## 5-step checklist (do this for every site you maintain)
1. Find the PHP version. Hosting control panel, or in WordPress: Tools, Site Health, Info, Server.
2. Compare it to the patched releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (or newer).
3. Back up the site and database first.
4. Update PHP in your hosting panel, or ask your host to do it.
5. Reload the site and test the contact form, login and checkout.
Only check sites you own or manage. Do not test other people's sites.

## Client notice (copy, edit, send)
Subject: PHP security update on your website

Hi [Name],

A critical PHP security update was released on Oct 21. We checked your site, updated PHP to a patched version, and tested the main pages and forms. No action is needed from you.

If you would like us to review anything else on the site, just reply to this email.

[Your name]

(If you have not updated yet, replace the second sentence with: "We are updating PHP on [date] and will confirm once it is tested.")