The PHP project released urgent security updates on October 21 for two critical vulnerabilities that could allow unauthenticated attackers to execute code on affected servers. The project says installing a fixed release is the only complete mitigation, so website owners should confirm that their hosting environment has been patched.
Key Highlights
- The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2.
- Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- The PHP project says systems serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
- PHP 8.1 and earlier are end-of-life upstream; some operating-system vendors may provide backported fixes, so check the specific vendor advisory.
What the PHP Updates Fix
The PHP security advisory describes two vulnerabilities in the language runtime that can lead to remote code execution without authentication. One involves memory corruption during out-of-memory handling; the other involves stale internal request state. Because these issues affect the PHP runtime itself, a WordPress plugin or theme update cannot replace the required PHP-level fix.
The PHP project lists the fixed versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It says there are no complete workarounds and recommends updating immediately. Read the official PHP security advisory for details.
Who Could Be Affected?
The advisory covers PHP installations that serve web requests. The fixed upstream releases apply to the supported 8.2, 8.3, 8.4 and 8.5 branches. PHP 8.1 and older do not receive a new upstream fix for these flaws, but some Linux distributions and hosting vendors maintain their own packages and may backport security patches. Check the package or provider advisory rather than relying only on the version number.
The European Union Agency for Cybersecurity and other European cybersecurity bodies also urged organisations to identify exposed PHP applications and apply the released updates. Their joint statement recommends prioritising internet-facing systems.
What Website Owners Should Do
- On shared or managed hosting: Contact the provider or check its status page to confirm the relevant PHP runtime or package has been patched.
- On a self-managed server: Install the security update for the active PHP branch, restart or reload the relevant services if required, and verify that all workers use the patched build.
- On older PHP versions: Check the operating-system or hosting vendor’s security notice. If no patched package is available, plan a move to a supported PHP branch and test compatibility before switching.
- For WordPress sites: Review the server information in Tools → Site Health → Info, then confirm the actual patch status with your host. A version string alone may not show a vendor-backported fix.
Security controls such as a web application firewall may reduce exposure in some circumstances, but they should not be treated as a replacement for the vendor’s PHP security update.
What Is Known About Exploitation?
Security researchers and vendors have published warnings about the risk of exploitation, and technical details can make unpatched systems more attractive targets. Reports about attack attempts can differ by observer and time period, so avoid treating any single company’s estimate as a complete count of affected or attacked websites. The safest practical step for site operators is to verify patch status and review relevant logs for suspicious activity.
Reuters reported that developers issued the updates after the flaws were disclosed and that organisations were rushing to secure affected systems. Read Reuters’ report on the PHP security release.
What to Watch Next
Website owners should monitor the official PHP advisory and their hosting provider’s security notices for package-specific guidance. PHP 8.2 is scheduled to reach upstream end of life on December 31, 2026, so administrators using that branch should also plan their next supported-version upgrade.
This report is for general news and information and is not a substitute for security advice tailored to a specific server.
Sources: PHP project advisory; ENISA joint statement; Reuters.