Critical PHP security patches: is your restaurant’s website covered?
Two critical PHP flaws were patched on October 21. The sites Blizzfull manages are updated. Here’s what to check on any website managed somewhere else.
Hey, just a quick heads-up. On October 21, 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP is the software that runs WordPress and WooCommerce, along with Drupal, Joomla, Magento and PrestaShop, so a lot of restaurant websites sit on top of it.
PHP says both flaws can let an attacker run code on a web server without signing in, and that updating is the only complete fix. The FBI’s Cyber Division has also urged organizations to update affected PHP installations right away.
The sites we manage are already patched
Blizzfull sites were patched within two minutes of the official security patch becoming available. If Blizzfull manages your website, there’s nothing you need to do.
Running PHP doesn’t mean a website was broken into or that any passwords were exposed. It means the server needs the update.
If your website is managed somewhere else
Plenty of restaurants also have a WordPress site, or a second website, that another web team or hosting company looks after. Those need their own check. If you’re a Blizzfull partner, please pass this along to your merchants’ web teams.
- Ask your web team or hosting provider to confirm the server runs a fixed PHP release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release in the same line.
- Updating WordPress, plugins and themes won’t fix this on its own. PHP is updated on the server, by your host or server administrator. Keeping WordPress current still matters.
- If the site runs PHP 8.1 or older, the PHP project no longer ships updates for it. Ask your host about upgrading.
- While they’re checking, look for unusual activity and remove any plugins, themes or administrator accounts nobody uses.
- If a server can’t be secured promptly, the FBI advises taking it offline until it can be.
Not sure who manages your website?
Ask us. We’ll tell you whether it’s one of the sites Blizzfull manages, and if it isn’t, what to ask your host. Reach our team through Blizzfull support or the form below.
Sources: the PHP project’s security release, October 21, 2026 and the FBI Cyber Division’s advisory.
Tell us about your restaurant.
Leave your email and the best time to call. A person on our team will get back to you.
Contact request · Received
Thank You!
We will contact you shortly.
Received
A mom-and-pop should never lose to a chain on anything.
With Blizzfull, it doesn’t have to.
2,500+ restaurants served24/7 support(213) 529-3956