iGears · Hong Kong website and systems support
Urgent PHP Patching & Website Migration
iGears is ready to help companies and organisations urgently patch or migrate websites affected by the PHP vulnerabilities.
Any company or organisation needing urgent PHP patching, an upgrade or a website migration can contact iGears. With 22 years of implementation experience since 2004, we help establish exposure, test WordPress, Drupal and custom-application compatibility, and move remediation forward with backup and rollback arrangements in place.
For business websites, content platforms, online stores and PHP applications. Scope and timing depend on versions, access and test results.
Official advisories · Checked through 22 October 2026
Two critical vulnerabilities. A whole-site update decision.
On 21 October 2026, PHP released security updates for CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution. Fixes cover four PHP branches; actual exposure depends on the runtime serving web requests, its deployment and configuration. See the PHP announcement and CERT-EU advisory.
Government services taken offline as a precaution
The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD as three examples. Paris also announced maintenance for some PHP-based city sites. Precautionary action does not establish a breach, and the three examples are not a total count of affected websites.
Latest investigation and CMS guidance
On 22 October, the Dutch NCSC said it was investigating initial indications of successful exploitation and urged unpatched organisations to update immediately. Drupal’s security team also asked site owners to arrange PHP updates. Updating a CMS does not establish that hosting PHP is patched.
Service availability may change as patches are deployed; follow each authority’s latest updates. Read our PHP news report.
Widely used technology needs planned maintenance
A PHP update can touch application code, extensions, themes and business workflows. These adoption figures show technology reach; each installation still needs its own exposure assessment.
of sites with an identified server-side language use PHP
Denominator: surveyed websites whose server-side programming language W3Techs can identify.
PHP surveyof surveyed websites use WordPress
Denominator: all surveyed websites. Its share among sites with an identified CMS is 58.3%.
WordPress surveyof surveyed websites use Drupal
Denominator: all surveyed websites. Its share among sites with an identified CMS is 0.9%.
Drupal surveyDated 22 October 2026. Source: W3Techs. Denominators differ and technology usage overlaps. Figures cannot be added and do not measure vulnerable or compromised websites. Survey methodology.
Choose a practical route for your environment
Urgent assessment and security patching
Inventory public websites, administration tools, serving PHP runtimes, extensions and vendor packages. Match official advisories to your environment, prioritise risk and verify that the applicable fix is active.
Website migration and legacy upgrades
If hosting or legacy code limits patching, assess a move to suitable, supported hosting and a patched PHP runtime. Address dependencies and compatibility, prepare data and configuration backups, and arrange a tested cutover with a rollback plan.
WordPress, Drupal and custom-code compatibility
Check CMS software, plugins, themes and integrations. Test applicable workflows such as sign-in, forms, uploads, payment connections and scheduled jobs so the update fits real business operations.
Verify the fix in the website’s actual runtime
These are the upstream fix boundaries announced on 21 October 2026. Use a suitable release containing the fix in the branch, a later appropriate supported release, or a vendor-confirmed security backport.
| PHP branch | Fix introduced in | Deployment checks |
|---|---|---|
| 8.5 | 8.5.12 | Verify the vendor advisory, package revision and application compatibility. Restart relevant services after updating, then check the PHP runtime serving real web requests and the key workflows. |
| 8.4 | 8.4.27 | |
| 8.3 | 8.3.36 | |
| 8.2 | 8.2.35 |
Vendors may backport a fix while keeping an older base version, so a version number alone is insufficient. Command-line PHP can also differ from the website runtime. PHP 8.2 upstream security support ends on 31 December 2026: plan its next upgrade alongside the immediate fix. PHP 8.1 and earlier need a separate migration assessment. Version and support guidance.
A clear process for faster, effective remediation
Discover and prioritise
Confirm URLs, serving PHP runtimes, CMS software, extensions and critical workflows. Establish exposure, access requirements and the remediation scope.
Back up and test compatibility
Check data and configuration backups, recovery arrangements and rollback options. Test the update and key operations in an appropriate test environment.
Patch or migrate
Apply the agreed updates or switch to the tested target environment within the maintenance window. Confirm backup and rollback steps and coordinate with the hosting or software vendor where needed.
Verify and hand over
Check the runtime actually serving the site and its important functions. Record test results, patch evidence and ongoing maintenance recommendations.
Suspected compromise needs a separate response scope
Patching does not automatically remove existing attacker access. Unexpected files, accounts or access records may warrant a separately scoped log and compromise review.
years of implementation experience · Since 2004
Website expertise with a view of the business behind it
Since 2004, iGears has supported Hong Kong businesses and organisations with websites, content platforms, internal systems and digital operations. Our 22 years of implementation experience help us assess code, hosting, content and business workflows together, reducing missed dependencies and repeated clarification.
We focus on clear scope, verifiable results and a maintainable handover. Starting with your existing environment, we identify priorities and plan a practical route through patching, migration, upgrades and ongoing maintenance. About iGears.
Urgent PHP patching and website migration questions
Should we patch, upgrade or migrate the website?
If the current supported environment can receive the applicable update, assess patching first. Unsupported PHP, CMS software or dependencies may need a tested upgrade. If the host cannot supply a suitable update or its restrictions prevent remediation, consider migration. The target must also include the applicable fixes: moving the site alone does not resolve the vulnerabilities. We recommend a route after assessing the actual environment.
Does updating WordPress or Drupal also patch PHP?
Not necessarily. CMS software and hosting PHP are separate components. Verify the PHP package serving web requests, its patch status and any required service restart. If your hosting provider manages PHP, check its update notice and completion evidence.
Do we have to move to the highest PHP version?
Choose a supported version that contains the applicable fix and is compatible with the website. A vendor-confirmed security backport may also be appropriate. Legacy systems usually need CMS, extension and custom-code testing before a migration target is selected.
Can configuration changes replace the update?
Some settings or access restrictions reduce selected attack paths. However, PHP and Drupal state that an update containing the patches is the only complete mitigation for these two vulnerabilities. Temporary measures need a plan to complete remediation promptly.
How long will it take, and will the website go offline?
We assess versions, dependencies, access, backup status and maintenance windows before proposing a schedule. Some updates require service restarts. Testing, recovery and deployment steps are planned first, with the expected impact explained.
Can we enquire without an internal technical team?
Yes. Start with the website URL, hosting provider and any version information you already have. We can help identify what needs confirming with the host or original developer. Do not send passwords or other secrets in your enquiry.
Need urgent PHP patching or a website migration? Contact iGears
iGears is ready to help companies and organisations address this PHP issue. Start with your website URL, current PHP, CMS and plugin versions if known, critical workflows and preferred maintenance window. We will review the environment and scope before proposing urgent patching, an upgrade or migration and its schedule.
Do not send passwords, private keys, access tokens or complete customer data. Appropriate access arrangements will be agreed before work begins.
Official references and further reading
Risk and release information checked through 22 October 2026. Follow subsequent PHP and vendor updates: PHP announcement, 21 October; CERT-EU 2026-018, 21 October; Dutch NCSC update, 22 October; and Drupal’s PHP update notice.