PHP Security: Why Updates and Layered Protection Matter

Websites depend on layers of software working together. The PHP runtime—the engine behind many websites and business applications—is one of them. Like the operating system, content management system, themes, extensions, and hosting control panel, PHP needs timely updates.

A firewall or DNS/CDN service can add useful protection, but each does a different job. Neither one installs a PHP update or fixes vulnerable application code.

Recent PHP security updates

On October 21, 2026, the PHP team announced security releases PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The releases address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP says could allow unauthenticated remote code execution in PHP installations serving web requests. PHP urged users to update. The PHP 2026 news and security archive lists the fixed versions and vendor guidance.

PHP 8.1 and older no longer receive updates from the PHP project. Some operating system and long-term support vendors may provide their own backported fixes, so a version number by itself may not tell the whole story. Ask your hosting provider which PHP package is running and whether it includes the fixes or has a supported upgrade plan.

PHP also announced updated Windows packages on October 26 that include a fix for a bundled Brotli issue, CVE-2026-111497. PHP notes that the affected path involves its cURL extension when automatic response decompression is enabled; this option is off by default, though an application or library can enable it. If your site runs on a Windows PHP package, ask your provider whether the updated package applies to your setup.

What a web application firewall can add

A web application firewall, or WAF, sits in the path of website traffic and checks requests before they reach the application. Rules can block traffic that matches known unwanted or harmful patterns. This gives a site another screening layer and can help reduce exposure while an update is being arranged.

Sucuri's Website Firewall documentation describes its cloud service routing site traffic through its network, where it filters requests. The documentation also describes WAF and intrusion detection features, caching, and virtual patching. Those capabilities depend on the service being set up for the right site and traffic. A WAF does not replace updating PHP: the vulnerable software is still on the server until it is patched or replaced.

Cloudflare DNS, CDN, and web protections do different jobs

DNS is the internet's directory: it helps browsers find the server for a website. Cloudflare's DNS proxy setting determines whether supported web traffic passes through Cloudflare's network. When a web record is proxied, Cloudflare can apply configured services such as caching and WAF rules. When the record is DNS-only, it points visitors to the origin directly, so that request does not pass through Cloudflare's HTTP proxy layer.

That distinction matters. Using Cloudflare for DNS alone does not mean a website's requests are being checked by a Cloudflare WAF or served through its CDN. The relevant web hostnames need to be proxied, and the protection rules the site needs must be enabled and configured. Cloudflare explains this in its official proxy status documentation and WAF overview.

Sucuri's Website Firewall also uses a DNS change to route website traffic through its firewall before it reaches the hosting server. Cloudflare and Sucuri offer different products and settings, so the useful question is not simply whether a company uses either brand. Ask which hostnames and traffic are covered, which protections are turned on, and whether the hosting server can still be reached directly.

Keep the layers working together

Updating PHP closes a known gap in the software itself. A WAF or proxy can inspect some web requests before they reach that software. CDN caching can help deliver eligible content efficiently. DNS gets a visitor to the right place. These protections complement one another, but none makes the others unnecessary or guarantees that a website cannot be compromised.

For a practical check, ask your website host or IT provider to:

• List the websites and applications that run PHP, including separate test or older sites.
• Confirm the PHP version and package on each one, the relevant security fixes, and a plan for unsupported versions.
• Confirm that each web hostname is routed through the intended proxy and that the WAF rules are active and tested.
• Review any Windows PHP package or unusual application configuration against the current PHP security guidance.
• Keep the site's content management system, extensions, and other server software updated too.

Timely updates are routine maintenance with an important business payoff: fewer known weaknesses left open for attackers to find. If PHP hosting, patch schedules, or web protections are on your technology checklist, contact Soarin Group to discuss your priorities.