Two critical PHP vulnerabilities put web servers at risk: Seintec has already applied the fixes
The NSA, CERT-EU and INCIBE warn of two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619), scored 9.2 out of 10. Seintec immediately applied the fixes to its systems and moved the affected hosted websites to a patched version of PHP 8.
News summary
According to 20minutos, on Wednesday 21 October 2026 the US National Security Agency (NSA) warned of two critical vulnerabilities in PHP, the programming language used by around 70% of the world’s websites. The agency urged every organisation using PHP to install the update and recommended temporarily disconnecting systems that cannot be updated straight away.
The flaws (CVE-2026-109618 and CVE-2026-109619) have a severity score of 9.2 out of 10. According to cybersecurity firm Wiz, they could allow a remote attacker to execute code without logging in and, in one case, read sensitive information from the server’s memory. CERT-EU, the UK’s National Cyber Security Centre and Spain’s INCIBE, which rated it as critical, have joined the warning.
Seintec immediately applied protective measures and updated the affected systems with the available fixes. On its hosting services, PHP 7.x has been temporarily disabled and the affected websites have been set to use a patched version of PHP 8. This change may cause errors on sites that are not compatible with PHP 8, especially older WordPress installations or those with outdated themes and plugins.
Seintec is developing and validating a PHP 7.4 build to temporarily serve the websites that still need it, while their owners adapt them to a supported PHP 8 version with current security patches. For those without a web maintenance provider, Seintec will soon offer an exceptional review and update service, quoted in advance according to each site’s architecture and components.
Source: 20minutos — 21 October 2026
Frequently Asked Questions
- What has Seintec done about these vulnerabilities?
- It immediately applied the available fixes to its systems and, on hosting, temporarily disabled PHP 7.x and set the affected websites to a patched version of PHP 8.
- What should I do if my website has stopped working?
- Check your website and contact the company that built or maintains it to confirm its compatibility with PHP 8. If you have no provider, you can contact Seintec for help.
Concepts mentioned in this article: Cybersecurity
If your website or servers use PHP, check their version now. At Seintec we help you verify compatibility and plan the update. Talk to our team.
Contact SeintecRelated service
Cybersecurity
We shield your business so it never stops.