The October 2026 PHP RCE — what to do
CVE-2026-109618/109619 hit millions of PHP sites. Here is how to respond, and how to avoid the next one entirely.
The PHP RCE wave, and the calm way out
In October 2026, two unauthenticated remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) were disclosed and actively exploited. Because WordPress, Drupal, Joomla and Magento all run on PHP, millions of sites were exposed within days.
If you run a PHP site, the immediate steps are: update PHP to a patched release, update your CMS core and every plugin, rotate credentials, and check logs for signs of compromise.
The longer-term answer is to stop being a target. Host My EmDash runs no PHP and no origin server, so this class of vulnerability does not exist on the platform. Sites are isolated per tenant, bot-protected at signup, and always current — there is nothing for you to patch when the next CVE lands.