Critical PHP Vulnerabilities and Legacy CMS Risks

On October 21, 2026, the PHP development team released urgent security updates for two critical vulnerabilities affecting websites and applications that use PHP. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each received a severity score of 9.2 out of 10 under CVSS 4.0. Under certain conditions, they can allow an attacker to execute code on a server without logging in.

According to PHP's official security advisory, all PHP installations that serve web requests are potentially at risk. A working exploit has been demonstrated against Apache running PHP as a module. In that configuration, an attack can be triggered before the website's own code starts running.

These vulnerabilities are a particular concern for websites that have gone years without proper maintenance. Updating an older content management system is not always straightforward. The problem may lie in PHP itself, the CMS, or a plugin installed years ago.

How Can the PHP Vulnerabilities Be Fixed?

The PHP security team released four patched versions on October 21: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Installing one of these versions, or a later release containing the same fixes, addresses the two vulnerabilities.

The PHP team has made clear that updating is the only complete solution. Certain server configuration changes may reduce exposure, but they do not eliminate the risk.

PHP 8.1 and older releases no longer receive security updates from the PHP project. Some operating system vendors still provide their own fixes for older versions, but moving to a supported PHP release remains the better long-term approach. Official security support for PHP 8.2 also ends on December 31, 2026.

You can check the official PHP support schedule for the current status of each release.

Before upgrading, the website's PHP version and other dependencies need to be checked. On older CMS installations, an upgrade may break plugins or custom features. Testing the update in a separate environment and taking a reliable backup before deployment can prevent avoidable downtime.

Why Are Outdated Content Management Systems a Security Risk?

Content management systems such as WordPress, Joomla, and Drupal have been widely used for years. Their supported versions remain suitable for websites that receive regular maintenance. Problems tend to develop when a site runs for years without updates.

Plugins are a common source of trouble. An older corporate website may have plugins that nobody uses anymore. Others may have been abandoned by their developers or may no longer work with newer PHP releases.

Removing them is not always simple. One plugin may depend on another, and replacing it can affect an unrelated feature. A theme written years ago may also stop working after a PHP upgrade.

To avoid breaking the website, a company may postpone updates. That leaves known vulnerabilities unpatched.

The newly disclosed PHP flaws are only part of the problem. The CMS itself, its plugins, or its themes may contain separate vulnerabilities. Running the latest PHP version will not fix security issues in those other components.

Does Every Corporate Website Need a Full CMS?

Some companies use their website mainly to publish service descriptions, references, and a contact form. Their content might change only a few times a month. A large content management system with numerous plugins may be unnecessary for that kind of website.

A simpler website with prebuilt pages may meet the same needs. If staff need to edit content, a separate management application can provide the features they actually use.

From a security standpoint, the relevant question is how much software and how many entry points the website exposes. Unused plugins, administration pages, and other components still require maintenance. They may also introduce vulnerabilities that attackers can exploit.

Removing software that the website does not need can make security maintenance easier. The same principle applies to web applications beyond traditional CMS platforms.

What Can a Custom-Built Website Offer?

With a custom-built website, the company can decide which features are necessary before choosing how to implement them.

A business that rarely changes its content might need a fast, straightforward website with a simple editing process. Another company may need a content management application with separate permissions for different employees.

In a larger project, the website can work directly with the company's existing systems. Contact form submissions can feed into a customer management system. Employees can be given permission to edit only the content they are responsible for. Changes can go through an approval process before publication.

There is no need to include general-purpose features the company never uses. As requirements change, the application can be developed around them.

Custom software is not automatically more secure, however. Poorly written code and outdated libraries can expose a custom application to the same kinds of problems. Security depends on how the software is developed, tested, deployed, and maintained.

The advantage of a purpose-built system is greater control over its components and a maintenance process designed around the business's actual needs.

When Should You Replace an Old CMS?

If an existing website can be kept up to date, meets the company's needs, and is affordable to maintain, replacing it may not be necessary. Some signs, however, suggest that the underlying system deserves a closer look.

Perhaps upgrading PHP would require rewriting several plugins. Even small content changes might need developer support. Or some of the site's core components may no longer receive security updates. Over time, the cost of maintaining that setup can become difficult to justify.

Business requirements can also outgrow an older CMS. At that point, adding more plugins may be less practical than building a content management application around the company's workflows.

A migration needs to account for more than the new website. Existing content and URLs must be preserved or properly redirected, and search engines must be able to crawl the new pages.

Google recommends permanent redirects from old URLs to their new equivalents during a site move. Without a proper migration plan, visitors may encounter broken links and the site's search visibility may suffer.

See Google's website migration guidance for more information.

Plan Your Website's Security and Future with Intellego

At Intellego Softworks, we develop corporate websites, content management applications, and custom software built around companies' business processes. We also help modernize existing applications and maintain systems after deployment.

For systems we maintain, we review the software and its dependencies, follow relevant security advisories, plan updates, test changes, and monitor applications after deployment.

If your current CMS is too old to update safely or no longer meets your needs, we can help you evaluate a replacement. That might mean a new website, a content management application with only the features your team needs, or a gradual modernization of your existing system.

We begin by examining what you already use and what your business requires. The goal is to avoid unnecessary development work and deliver software your company can continue to maintain.

To review your website's security or discuss a custom application, contact Intellego Softworks.