Key Takeaways
- Check the installed PHP version through WordPress Site Health, your hosting dashboard or your hosting provider.
- Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; vendor backports may also address the flaws.
- Verify patches, test important site functions and investigate suspicious activity after updating.
Canada Warns of Critical PHP Security Flaws That Could Put Websites at Risk
Your website is working perfectly. Customers are placing orders, visitors are reading articles, and everything looks normal.
But what if a hacker could exploit your website's server without even knowing your password?
That is the risk behind an urgent cybersecurity warning issued by the Canadian government on October 21, 2026.
The Canadian Centre for Cyber Security has warned about two critical vulnerabilities in PHP, a programming language used by WordPress and many other websites. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable servers without authentication.
Both vulnerabilities carry a critical severity score of 9.2 out of 10.
Does that mean your website has been hacked? No. But if it runs an affected PHP installation, waiting could be dangerous.
Here is how to check your website, understand the risk using free AI tools, and take the right steps to protect it.
Step 1: Check Whether Your Website Uses PHP — For Free
First, find out what technology powers your website.
You don't need programming skills. Start with one of these tools.
Option A: Wappalyzer
- Visit Wappalyzer.
- Create a free account if required.
- Enter your website address.
- Review the detected technologies.
- Look for PHP, WordPress or other PHP-based applications.
Wappalyzer offers 50 technology lookups per month on its free account.
Option B: BuiltWith
Visit BuiltWith and enter your domain to explore publicly detectable website technologies. Individual-site lookup information is available without purchasing an enterprise research plan, although certain features require payment.
What if PHP doesn't appear?
Don't assume you're safe. These tools rely on publicly visible information, and many servers deliberately hide their software details.
A website technology lookup is a starting point, not a security certificate.
Step 2: Find Your Actual PHP Version
Now comes the important part: determining which PHP version your website runs.
If you use WordPress:
- Log in to your WordPress dashboard.
- Open Tools → Site Health.
- Select the Info tab.
- Expand Server.
- Find the PHP version.
For example, you might see PHP 8.4.26.
Write that number down. It will help you determine whether your installation needs an urgent update.
Not using WordPress?
Check your hosting dashboard, such as cPanel or Plesk, or contact your hosting provider. If you're using managed hosting, the company may handle PHP security updates for you.
AI Prompt 1: Help Me Check My Website
Not sure where to look? Copy this prompt into ChatGPT:
Act as a website security adviser.
My website is: [WEBSITE URL]
My hosting provider is: [NAME OR UNKNOWN]
Help me determine whether my website appears to use PHP.
Explain:
1. What can be identified from public website information.
2. Whether my website appears to use WordPress or another PHP-based system.
3. Where I can find the actual PHP version.
4. How to check it without changing website settings.
Use simple, beginner-friendly instructions.
Do not guess my PHP version or claim my website
is secure based only on its URL.
Do not request passwords or sensitive information.
Remember: ChatGPT may help identify website technologies, but it cannot reliably determine the installed PHP version from a domain name alone.
Step 3: Is Your PHP Version Vulnerable?
Once you have your version number, compare it with the Canadian government's security advisory.
The following releases contain fixes for the two reported vulnerabilities:
| PHP Branch | Minimum Fixed Version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Suppose your WordPress dashboard displays PHP 8.4.26.
That version falls below the fixed release, PHP 8.4.27, meaning the relevant security update is missing unless your vendor has supplied an applicable backported patch.
What if your server runs PHP 8.1 or older? Those versions no longer receive security updates directly from the PHP project. You should arrange an upgrade or verify that your operating-system or long-term-support vendor supplies the necessary security fixes.
Meeting the minimum version threshold addresses these specific vulnerabilities. It does not guarantee that your website is protected against every cyberattack.
AI Prompt 2: Is My PHP Version Safe?
Copy this prompt after finding your PHP version:
Act as a PHP cybersecurity specialist.
My PHP version is: [ENTER VERSION]
My website platform is: [WORDPRESS / OTHER]
My hosting provider is: [NAME]
Canada issued cybersecurity alert AL26-026
on October 21, 2026.
Check whether my PHP version is affected by:
- CVE-2026-109618
- CVE-2026-109619
Use the official Canadian Cyber Centre and
PHP project advisories.
Explain:
1. Whether my version is in the affected range.
2. Which fixed PHP version I should use.
3. Whether vendor-backported patches could apply.
4. What I should do next.
5. How urgently I should act.
Do not declare my server safe unless the
relevant patch status can be verified.
Step 4: Fix Your Website Without Breaking It
Finding a vulnerable PHP version is only half the job. The next step is installing the appropriate security fix.
But don't blindly change server settings, especially if your website handles customer payments, bookings or business operations.
For managed hosting:
Contact your hosting provider and request confirmation that the affected PHP installation has been patched. Ask whether the company uses a newer PHP release or a vendor-maintained security backport.
For self-managed websites:
Have your administrator back up the website and database, assess compatibility, install the appropriate security update and verify that the running server is patched.
Test major functions afterward, including login pages, contact forms, shopping carts and payment processing.
For critical vulnerabilities, do not delay security remediation unnecessarily while waiting for routine maintenance.
AI Prompt 3: Help Me Fix My Website Safely
This prompt helps readers obtain instructions tailored to their website.
Act as an experienced website security
administrator.
My website platform: [WORDPRESS / OTHER]
My hosting provider: [NAME]
My current PHP version: [VERSION]
I need to protect my website against:
CVE-2026-109618 and CVE-2026-109619.
Using official documentation, create a
step-by-step security update plan.
Include:
1. How to create a verified backup.
2. What compatibility checks are necessary.
3. How to obtain the correct security update.
4. How to apply it safely on my hosting platform.
5. How to confirm the running PHP version.
6. How to test important website functions.
7. What to do if the update causes problems.
8. How to identify signs of earlier compromise.
Do not invent hosting dashboard options,
commands or configuration paths.
Do not ask for passwords, private keys,
database credentials or sensitive server files.
Warn me before any action that could cause
website downtime or data loss.
AI can make complex technical instructions easier to understand, but it does not install security patches merely by generating a checklist. Only apply instructions that match your actual hosting environment.
Step 5: Verify the Update — Don't Just Assume You're Protected
Your hosting company says the problem is fixed.
Great. But how do you know?
Start by checking your PHP version again. Confirm that the running installation meets the relevant fixed-version threshold or that your vendor has documented the applicable backported patch.
Next, test the website's important functions and ask your hosting provider to review server and application logs for suspicious activity.
Watch for unexpected administrator accounts, unfamiliar files, unusual server processes or unexplained outbound connections.
If your website shows signs of compromise, contact a qualified cybersecurity professional. Installing the update closes the known vulnerability but does not automatically remove malware or reverse damage from an earlier attack.
The Canadian Cyber Centre also recommends restricting exposure when immediate patching is impossible, including considering temporary isolation of vulnerable internet-facing applications.
TwikUp Insight: AI Can Guide You, but Security Updates Protect You
The biggest danger for many website owners isn't that they knowingly ignore cybersecurity. It's that they have no idea which software their website is running or who is responsible for updating it.
AI makes the first part easier. It can explain technical warnings, create checklists and help people ask their hosting providers the right questions.
But the real protection comes from verified patches, responsible website maintenance and ongoing security monitoring.
You don't need to become a cybersecurity expert. You do need to know who is protecting your website — and whether the latest security fixes have actually been applied.