Security advisory | 22 October 2026
Critical PHP vulnerabilities: update now
Two newly disclosed flaws in PHP, CVE-2026-109618 and CVE-2026-109619, allow attackers to run their own code on web servers without logging in. Fixes are available, and attacks have already been reported.
9.2 / 10
Critical severity rating (CVSS v4.0) for both flaws
No login
Attackers need no username or password
22.6m
Exposed PHP instances identified as potentially vulnerable
Active
Attacks reported before the fixes were released
What has happened
- On 21 October 2026 the PHP project released urgent fixes for two flaws in PHP, the programming language behind a large share of websites and web applications.
- Both flaws allow remote code execution: a crafted web request lets an attacker run their own code on the server, before the website's own code even starts. One of the flaws can also leak data held in server memory.
- Details leaked on 20 October and attacks were reported hours before the fixes were published.
- PHP states there is no complete workaround. Updating is the only safe fix.
Who is affected
- Any organisation running PHP on its own servers, in containers or on hosted platforms. Researchers report the affected code dates back to PHP 5.4, released in 2012.
- Platforms built on PHP, such as WordPress, WooCommerce, Magento, Joomla and Laravel, are exposed even when their own code is secure.
- Apache servers running PHP as a module (mod_php) carry the highest risk. Servers using PHP-FPM are also affected.
- Sites and applications that suppliers or hosting providers run for you may be affected too.
What to do now
Check your version
| Version | What to do |
|---|---|
| 8.5 | Update to 8.5.12 |
| 8.4 | Update to 8.4.27 |
| 8.3 | Update to 8.3.36 |
| 8.2 | Update to 8.2.35 |
| 7.4, 8.0, 8.1 | Out of support. Apply PHP's emergency backport or your vendor's patched package, then plan an upgrade to a supported version. |
| 7.3 or older | No fix available. Upgrade, or isolate the system until you can. |
Linux distributions and hosting control panels, including Debian, cPanel and Plesk, have published patched packages. Use these where you can.
Take these steps
- Find every PHP installation: web servers, containers, build pipelines and hosted sites.
- Update using your operating system or hosting provider's patched packages where available.
- Restart all PHP and web server processes so the fix takes effect.
- Check systems that were exposed before patching for signs of compromise. Updating does not remove an attacker who is already in.
- Confirm with suppliers and hosting providers that they have patched.
Some web application firewall providers have released rules that block known attack patterns. These reduce risk while you patch, but they do not replace updating.
How Shaping Cloud can help
Our Managed Services team offers one-off, hourly support, whether you need a clear view of your risk or hands-on help to fix it.
Risk assessment
We find where PHP runs across your estate, confirm versions and exposure, check for signs of compromise and give you a prioritised plan.
Remediation
We apply the updates or upgrades, test your services and work with your suppliers to close any gaps.