PHP Issues Four Emergency Fixes for Two Critical Security Flaws

The problems, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP versions used by websites around the world. According to the PHP security advisory, the risk is particularly high for servers running Apache with mod_php. An attack can begin before the website’s own code runs.

One in Three PHP Sites Uses an Older Version

PHP is used by 69.3% of websites with a known server-side programming language, according to W3Techs. Its October 22 figures also show how many PHP websites still rely on older releases:

• PHP 7 – 26.9%;
• PHP 5 – 7.7%;
• PHP 4 – 0.1%.

Together, those versions account for 34.7% of PHP websites, according to a 15M calculation. None receives regular security updates from the PHP project, although hosting providers may offer their own patches.

These figures cover the wider internet, not gambling websites specifically.

Gambling Sites Also Rely on PHP

A BuiltWith report dated October 14 identified 1,096 gambling and betting websites using WordPress 6.6. That is only one version of the PHP-based CMS, so the total number using WordPress is higher.

For gambling operators, the issue may sit outside the main betting platform. Promotional websites, affiliate portals and other pages can run on PHP even when the sportsbook itself uses different software.

WordPress Updates Won’t Patch PHP

The vulnerabilities concern the PHP engine rather than a particular WordPress plugin or theme. Updating a site’s CMS alone would not fix an affected PHP installation.

The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older installations need to be checked for their PHP version and either upgraded or patched by the hosting provider.