{"id":5531,"date":"2026-10-26T12:13:51","date_gmt":"2026-10-26T10:13:51","guid":{"rendered":"https:\/\/peterteszary.com\/?p=5531"},"modified":"2026-10-26T12:13:52","modified_gmt":"2026-10-26T10:13:52","slug":"kritikus-php-sebezhetoseg-2026-oktobereben","status":"publish","type":"post","link":"https:\/\/peterteszary.com\/en\/kritikus-php-sebezhetoseg-2026-oktobereben\/","title":{"rendered":"Critical PHP vulnerability in October 2026"},"content":{"rendered":"<h2 class=\"wp-block-heading\">This is how you protect your WordPress website.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At the end of October 2026, a very serious vulnerability shattered the web community, affecting a significant portion of the servers that serve websites. The vulnerability discovered by security experts (known in the industry as \u201cPHP2Shell\u201d) opens a loophole for attackers on servers running older PHP versions. If you\u2019re a website owner, it\u2019s crucial to check your system now.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, I will show you exactly what the problem is, who it affects, and how you can check whether your website is safe even without technical knowledge.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What exactly happened?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The latest critical PHP vulnerabilities (including CVE-2026-109618 and CVE-2026-109619) were released in the third week of October 2026. The essence of the vulnerability is that under certain conditions, attackers can run malicious code remotely on the server, which in the worst case can lead to a loss of full control over the website, data leaks, or infecting visitors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since WordPress is a PHP-based system in itself, the security of the engine running in the background is critical. Your website is full of the best security plugins in vain, if the server environment itself is vulnerable, the walls can collapse.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is affected by the problem?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This issue affects older PHP versions. If your hosting is running one of the following versions, your site may be at risk:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PHP 7.4 (has not been supported for a long time)<\/li>\n\n\n\n<li>PHP 8.0 and 8.1<\/li>\n\n\n\n<li>Certain subversions of PHP 8.2<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The solution is <strong>PHP branch 8.3 (with a minimum of version 8.3.36)<\/strong>, and the more recent releases that have already been prepared for this, in which the developers have already patched these vulnerabilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to check the PHP version of your website (in WordPress)?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You don't have to be a programmer to figure out what kind of engine drives your website. With WordPress\u2019 built-in tools, you can check in no time:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Go to your WordPress dashboard (Admin interface).<\/li>\n\n\n\n<li>In the menu on the left, find the <strong>Assets<\/strong> menu, and then click <strong>Site Health<\/strong> option.<\/li>\n\n\n\n<li>On the page that appears, at the top, switch to <strong>Information<\/strong> tab.<\/li>\n\n\n\n<li>Scroll down and open the <strong>Server<\/strong> section.<\/li>\n\n\n\n<li>Here, right around the first or second row, you will find the <strong>PHP version<\/strong> value.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How do you evaluate the result?<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>8.3 or later (e.g. 8.3.36):<\/strong> I have great news, your website runs in the most up-to-date and secure environment. There is no further action to be taken.<\/li>\n\n\n\n<li><strong>7.4, 8.0, 8.1 or 8.2:<\/strong> Intervention is required. Your hosting should be updated to the latest version of PHP as soon as possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to do if you need to update?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can switch the PHP version not within WordPress, but through your hosting provider\u2019s interface (e.g. cPanel, Rackhost admin, DirectAdmin). For most providers, this is available under \u201cSelect PHP Version\u201d, \u201cPHP Settings\u201d, or \u201cMultiPHP Manager\u201d. Here, simply select version 8.3 from the drop-down menu and save the settings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Tip: After changing the version, be sure to click through the main features of your website (add to cart, submit forms) to make sure that both the plugins you use and your template are flawlessly compatible with the new environment.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your website is maintained by a professional, chances are you\u2019ve already taken care of this update. In recent days, I have also switched my managed systems and dedicated servers to new, secure protocols.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you don\u2019t have an active maintainer, aren\u2019t sure, or simply don\u2019t want to touch server settings, don\u2019t let your security hang in the air. Contact your hosting provider or feel free to contact me for an ad-hoc order and I\u2019ll help you secure your system.<\/p>","protected":false},"excerpt":{"rendered":"<p>At the end of October 2026, a very serious vulnerability shattered the web community, affecting a significant portion of the servers that serve websites.<\/p>","protected":false},"author":1,"featured_media":4034,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"slim_seo":{"facebook_image":"https:\/\/peterteszary.com\/wp-content\/uploads\/2025\/06\/Default-Blog-Cover.webp","twitter_image":"https:\/\/peterteszary.com\/wp-content\/uploads\/2025\/06\/Default-Blog-Cover.webp","title":"Kritikus PHP sebezhet\u0151s\u00e9g 2026 okt\u00f3ber\u00e9ben - peterteszary.com","description":"A 2026-os \u00e9v okt\u00f3ber\u00e9nek v\u00e9g\u00e9n egy rendk\u00edv\u00fcl s\u00falyos biztons\u00e1gi r\u00e9s r\u00e1zta meg a webes k\u00f6z\u00f6ss\u00e9get, amely a weboldalakat kiszolg\u00e1l\u00f3 szerverek jelent\u0151s r\u00e9sz\u00e9t \u00e9rinti."},"_slim_seo_primary_term_category":563,"_slim_seo_primary_term_post_tag":14,"footnotes":""},"categories":[563],"tags":[14],"class_list":["post-5531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-weboldal-mukodes-es-karbantartas","tag-wordpress"],"meta_box":[],"_links":{"self":[{"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/posts\/5531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/comments?post=5531"}],"version-history":[{"count":2,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/posts\/5531\/revisions"}],"predecessor-version":[{"id":5533,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/posts\/5531\/revisions\/5533"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/media\/4034"}],"wp:attachment":[{"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/media?parent=5531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/categories?post=5531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/peterteszary.com\/en\/wp-json\/wp\/v2\/tags?post=5531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}