On 21 October 2026 the PHP project released fixes for two critical vulnerabilities that could let an attacker run code on a web server without logging in. PHP powers WordPress and WooCommerce, so a large share of UK online shops are exposed until their hosting is patched. If you take card payments through a WooCommerce store, this is a same-day job, and it needs doing at the server level.

What has happened

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. According to the PHP Foundation, both involve memory handling and error handling, which almost every request touches. Researchers have demonstrated remote code execution, and proof-of-concept material circulated after a leak ahead of the planned release. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The UK's National Cyber Security Centre has published an alert urging organisations to identify every PHP installation, prioritise internet-facing systems and update to a fixed version.

Does this affect the Monek WooCommerce plugin?

The weakness is in PHP, the language your server runs, not in WordPress, WooCommerce or any specific payment plugin. The WooCommerce developer team has said WooCommerce itself is not affected and that no WooCommerce or WordPress update is required. The same applies to our free WooCommerce plugin: the action for Monek merchants is to update PHP on your hosting, then keep the plugin, WordPress and WooCommerce up to date as you normally would. Our plugin runs on PHP 8.1 or newer, but PHP 8.1 no longer receives upstream security fixes, so a move to a supported branch is worth planning.

What to do this week

Who does the work depends on where your store is hosted. The steps below are general guidance, so follow your host's own instructions where they differ.

  • Check your PHP version: in WordPress go to Tools, then Site Health, then Info, then Server. Note that some hosts backport fixes without changing the headline version number, so a package suffix or a host notice is a better guide than the number alone.
  • Ask your host: confirm in writing that the fix for both CVEs is applied and that PHP workers have been restarted, because old code can stay in memory until they recycle.
  • Self-managed servers and VPS: update through your package manager and restart PHP-FPM or Apache today. This group is the most urgent.
  • Shared hosting: use your control panel's PHP selector, and test on a staging copy first if you are moving between branches.
  • Check every install: staging sites, old subdomains and forgotten landing pages that run PHP count too.

WooCommerce recommends PHP 8.3 or newer. PHP 8.2 reaches end of life on 31 December 2026, so if you are patching within your current branch now, schedule the move to 8.3 on staging after the peak trading period rather than during it.

Why payments businesses should take it seriously

A server compromise is not just a website problem. An attacker with code execution could tamper with checkout pages, harvest customer details or plant a card skimmer, and the risk depends on how your checkout is built and hosted. Even if you suspect nothing has happened, check for unfamiliar files, unexpected admin users and changes to checkout scripts, and speak to your host or a specialist if anything looks wrong. Under card scheme rules you also have obligations if you believe card data may have been exposed, so tell your payment provider early rather than late. This is general information, not security or legal advice.

Where Monek fits in

Monek is an FCA-regulated payment provider (FRN 920628), and our free WooCommerce plugin connects your store to a UK payment gateway with next-day settlement and native Xero integration. If you have questions about how your checkout connects to Monek, or you would like a no-obligation rate comparison once your server is safely patched, talk to our team.