SECURITY ADVISORY · 2026-10-22
Critical PHP holes just dropped.
Here’s what to do.
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on unpatched PHP. CISA told organisations to patch immediately. If your site runs WordPress, Drupal, Magento or custom PHP, this is your host’s job — and yours to verify.
OUR SAMPLE · SAME DAY
What we saw on 26 Tampa Bay solar websites.
Passive re-check of the same anonymised sample from our solar teardown. No company names.
Out of 26 reachable sites. Hidden version ≠ safe.
18 showed no clear PHP signal on the homepage. That does not prove they are off PHP — only that our passive checks could not see it.
PLAIN ENGLISH
What “patch PHP” means for a local business.
- Who is at risk: any site whose web server runs PHP — including most WordPress sites.
- What to ask your host: “Are we on PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or newer, and did you restart PHP-FPM / Apache after upgrading?”
- What GoPilot checks: if the server advertises
PHP/x.y.z, we flag builds below those floors as high risk in the free report. If PHP is likely but the version is hidden, we tell you to confirm — we do not claim you are patched. - What we will not do: send exploit probes. That would be attack traffic. Version comparison from public headers is enough to act.
CHECK YOUR SITE
See whether your PHP version is exposed — free.
Enter your website above (or jump to the box). Security includes the Oct 2026 PHP RCE check when the version is visible, plus DMARC, SSL and the rest of the stack.
QUESTIONS
Straight answers.
What are these CVEs?
CVE-2026-109618 and CVE-2026-109619 — critical unauthenticated RCE in PHP, patched in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Sources: PHP project security release and CISA alert, 21 Oct 2026.
Do you hack my site to test it?
No. Headers and homepage signals only.
Why so few “vulnerable” in your sample?
Most hosts hide X-Powered-By. We found 1 clear vulnerable exposure and 7 likely-PHP with no version — those owners still need to ask their host.
FREE WEBSITE & MARKETING REPORT
How does your business
show up online?
Add your website for a free report in about two minutes, plus a ranked plan of what to fix first. No site yet? Still send the form — we’ll talk about building one.
- Security: SSL, security headers, email spoofing protection and lookalike domains
- Visibility: Google Business Profile, reviews, 30+ directories, local competitors and whether AI assistants know you
- Design: how your site looks on phones and desktops, speed and accessibility
- AI & automation: chat, online booking, tap-to-call and contact forms
- Marketing: analytics, ad tracking and email capture
What happens next
With a website: your report opens right away and is saved to your file with us. Without one: we get your inquiry and follow up about next steps. Either way, we’ll talk about the fixes that matter most.