PHP vulnerability: what should you email your developer?

Calling is fine, especially urgently. Email provides three advantages: written confirmation with version, evidence you acted if something later goes wrong, and a question your developer can forward to the server administrator.

Unsure whether PHP is present? Use the free Marketing Scan PHP check first to see whether this email is needed.

Use this if you hold your own hosting package, for example with a Belgian or Dutch provider.

Subject: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: website status

Hello,

Regarding CVE-2026-109618 and CVE-2026-109619 (php2shell), please confirm the exact PHP version used by [yourdomain.be]. Is it updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12? If not, when will this happen? If below 8.2, what steps do you recommend?

Please include the version number in your reply. Thank you.

Use this if a developer built or maintains your website.

Subject: Urgent: is our website protected against the PHP vulnerability?

Hello,

Two critical PHP flaws became public on 21 October (CVE-2026-109618 and CVE-2026-109619). Can you confirm whether [yourdomain.be] uses PHP, the exact version and whether it is updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12?

If you do not manage the server, could you check with the host? After updating, please also check for unknown administrators or files.

Please reply today. Thank you.

After a working day without response, send this and call immediately.

Subject: Follow-up: PHP vulnerability and our website

Hello,

Yesterday I asked whether [yourdomain.be] was updated for CVE-2026-109618 and CVE-2026-109619. I have not received a reply. Cloudflare already sees initial attack attempts, so I would like this resolved today. Please confirm the status or who I should contact.

Thank you.

The Cloudflare statement is factual rather than threatening, as reported by VRT NWS.

A good answer includes:

• an exact version, such as 'PHP 8.3.36', not simply 'PHP 8.3';
• a date or time when updating happened or is scheduled;
• a plan for old versions: PHP 8.1 or earlier needs an upgrade proposal because no fix will arrive, according to Help Net Security;
• confirmation of checks for signs of intrusion.

Be cautious of:

• 'We are looking into it.' Ask when and request the version.
• 'WordPress is updated.' The flaw is in server PHP, not WordPress.
• 'We have a firewall.' It helps temporarily, but Patchstack identifies updating as the only complete solution.
• 'Your site is too small to be attacked.' Scanning is automated, regardless of business size.

For PHP 8.1, 8.0, 7.x or 5.x, add this question:

'Our PHP version receives no fix. Please propose an upgrade to at least PHP 8.2, including time and cost estimates. Can the site be protected meanwhile, or should it temporarily go offline?'