Индустрия

PHP Under Attack: Two Critical Flaws Put iGaming Affiliate Websites at Risk.

Two serious PHP vulnerabilities rated 9.2 out of 10 make urgent patching essential for vulnerable websites. Here is what affiliate teams and WordPress publishers should check.

BETDILLA Editorial·October 21, 2026

Editorial illustration: PHP Under Attack: Two Critical Flaws Put iGaming Affiliate Websites at Risk

BETDILLA editorial illustration

Two security flaws you cannot ignore.

On October 21, the PHP project released emergency fixes for CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS severity score of 9.2 out of 10. Under certain conditions, an attacker could exploit memory-handling flaws to execute code on a vulnerable server without signing in to the website.

Why iGaming SEO teams should care.

Imagine an affiliate website that spent years building rankings, backlinks and organic traffic. If its server runs an affected PHP version, a successful compromise could threaten availability, customer data and domain reputation. WordPress installations, other PHP-powered sites, older landing pages and forgotten microsites all deserve attention. Using PHP alone does not mean a site has been hacked.

Which PHP versions need updating?.

PHP has published fixes for several maintained branches. Confirm the version actually running on your server, rather than relying on a CMS dashboard.

PHP 8.5: update to 8.5.12.
PHP 8.4: update to 8.4.27.
PHP 8.3: update to 8.3.36.
PHP 8.2: update to 8.2.35.
PHP 8.1 or older: ask your hosting provider about backported fixes and a supported-version upgrade path.

What role did AI play?.

Advanced AI systems assisted security researchers in finding and analysing the issues. OpenAI described coordinated defensive work with other specialists over roughly two months, while Google Cloud discussed research involving Wiz and Gemini-powered methods. Claims that a single ChatGPT model uncovered everything in eight hours do not fully reflect the reported investigation. What is clear is that AI-assisted research can accelerate vulnerability discovery.

Five things site owners should do today.

Check the PHP version running on every public server, not just the WordPress version.
Ask your host to confirm whether both security fixes are installed and when.
Back up files and databases before upgrading, and make sure recovery works.
After patching, test landing pages, forms, redirects, sign-in and uptime.
Review logs for suspicious activity. If updates are delayed, ask your host about temporary mitigations.

Is a security plugin enough?.

No. Application-level security plugins can reduce exposure in some scenarios, but they cannot be relied on to fix flaws in the PHP runtime itself. Installing the appropriate patch remains the priority.

What happens to the affiliate market next?.

There is no evidence that most gambling affiliate sites have already been compromised or will suddenly disappear from search results. The risk is still real for unpatched systems, especially those running neglected software. Careful infrastructure checks are more useful than panic.