PHP security vulnerabilities have become a major cybersecurity concern after the discovery of two critical flaws in the PHP programming language. On October 21, 2026, the PHP development team released emergency security updates to address vulnerabilities that could allow attackers to execute malicious code on affected servers without authentication.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have received critical severity ratings. Security organisations are advising businesses and website administrators to review their systems and install the available fixes as soon as possible.
PHP is widely used to develop dynamic websites, web applications, APIs, and content management systems. As a result, security problems affecting its core runtime can have consequences for a wide range of online services.
What Are the Latest PHP Security Vulnerabilities?
The latest security advisory identifies two serious vulnerabilities in the PHP runtime. Both have a CVSS v4.0 score of 9.2, indicating critical severity.
According to the official PHP advisory, the PHP security vulnerabilities involve problems with memory handling and internal request state. Under certain conditions, these flaws could allow unauthenticated remote code execution on vulnerable servers, potentially putting website data and server security at risk.
Remote code execution means an attacker may be able to run unauthorised code on a vulnerable system. Depending on the server configuration and permissions, this could put application data and system security at risk.
Security agencies have also reported concerns about active exploitation, making timely updates particularly important.
PHP Security Vulnerabilities: Key Details
| Detail | Information |
|---|---|
| Security issue | Two critical PHP vulnerabilities |
| CVE-1 | CVE-2026-109618 |
| CVE-2 | CVE-2026-109619 |
| Severity | Critical |
| CVSS v4.0 score | 9.2 each |
| Announcement date | October 21, 2026 |
| Main risk | Unauthenticated remote code execution |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
Source: Official PHP security advisory and European cybersecurity authorities.
Which PHP Versions Are Affected?
The advisory identifies PHP versions from 5.4 through 8.5.11 as vulnerable. The PHP project has released fixes for supported branches, including PHP 8.2, 8.3, 8.4, and 8.5.
The recommended fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and earlier no longer receive standard security updates from the PHP project. However, some operating system vendors may provide backported security fixes, so administrators should check their vendor’s advisory before deciding how to upgrade.
Website owners should confirm which PHP version their hosting environment actually uses instead of assuming that the website’s software or theme determines the runtime version.
Why Are These PHP Security Flaws Serious?
PHP powers many websites and web applications. A vulnerability in its core runtime can affect systems even when their application code does not contain an obvious programming mistake.
The main concerns include:
1. Remote code execution
An attacker may be able to execute unauthorised code on an affected server. The possible consequences depend on the server’s configuration and security controls.
2. Data security risks
A compromised server may expose sensitive information, including application data and configuration details. The extent of potential access depends on the permissions available to an attacker.
3. Website disruption
Security exploitation can affect the availability and reliability of online services. Organisations may need to investigate affected systems and take additional protective measures.
4. Wider application exposure
PHP is used by different hosting platforms and content management systems. Administrators should therefore check their underlying PHP runtime, including when it is managed by a hosting provider.
How Can Website Owners Respond?
Website owners and system administrators should prioritise the following security measures.
- Update PHP: Install the appropriate fixed release for the PHP branch in use.
- Check hosting environments: Confirm whether the hosting provider has applied the required security updates.
- Review older installations: Identify unsupported PHP versions and plan a move to a supported release.
- Inspect security logs: Review unusual activity and investigate signs of unauthorised access.
- Rebuild affected deployments: For containerised applications and custom server images, rebuild and redeploy using a patched PHP runtime where necessary.
- Verify third-party software: Check whether plugins, frameworks, or other bundled components include their own PHP runtime that requires separate remediation.
The PHP project states that there is no complete substitute for installing the security updates. Temporary configuration changes may reduce certain attack paths, but they should not replace patching.
What Does This Mean for WordPress and Other PHP Websites?
Many content management systems and website platforms rely on PHP. WordPress websites, for example, depend on the PHP runtime provided by their hosting environment.
The vulnerability does not automatically mean that every WordPress website has been compromised. However, website administrators should confirm their active PHP version and ensure that their hosting environment is protected.
Updating WordPress themes and plugins alone may not resolve a vulnerability in the underlying PHP runtime. The required fix must be applied at the appropriate server or hosting level.
Users of managed hosting should contact their providers if they cannot directly control the PHP version.
Latest Developments in PHP Security
As of October 22, 2026, cybersecurity organisations are urging administrators to take the PHP vulnerabilities seriously. The European Union Agency for Cybersecurity and other European authorities have called for prompt remediation, while New Zealand’s National Cyber Security Centre has warned of reports of active exploitation.
These developments highlight the importance of maintaining supported software versions and responding quickly to critical security advisories.
Official announcements remain the best source for checking affected releases, remediation guidance, and any subsequent changes to the security recommendations.
Also visit us: Attack on Dammam Airport: Latest News, Casualties And Updates
Frequently Asked Questions (FAQs)
1. What are the latest PHP security vulnerabilities?
The latest reported flaws are CVE-2026-109618 and CVE-2026-109619. They affect PHP’s core runtime and could permit unauthenticated remote code execution under certain conditions.
2. How severe are the PHP vulnerabilities?
Both vulnerabilities have a CVSS v4.0 score of 9.2, placing them in the critical severity category.
3. Which PHP versions have security fixes?
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address these vulnerabilities.
4. Can these vulnerabilities affect WordPress websites?
Yes, a WordPress website may be at risk if its underlying PHP runtime is vulnerable. Website owners should check their hosting environment and apply the appropriate security updates.
5. What is remote code execution?
Remote code execution is a security issue that can allow an attacker to run code on a remote computer or server. Its impact depends on the vulnerability and the system’s security configuration.
6. Is updating PHP necessary?
Yes. The PHP development team strongly recommends installing the relevant security release. Administrators should also investigate possible compromise if their systems were exposed while vulnerable.
Conclusion
The latest PHP security vulnerabilities demonstrate why regular software maintenance is essential for website security. The two critical flaws, CVE-2026-109618 and CVE-2026-109619, could expose vulnerable servers to unauthorised code execution.
Website owners, developers, and hosting providers should review their PHP installations, apply the appropriate fixes, and investigate suspicious activity where necessary. Keeping server software supported and up to date is an important step towards protecting website data, application availability, and user trust.
