Emergency security updates for two critical vulnerabilities in PHP were released on Wednesday, 21 October 2026, prompting urgent warnings to businesses and website operators. The flaws could allow attackers to run malicious code on affected web servers without needing to log in.
PHP is the programming language behind many popular website platforms, including WordPress, Drupal and Joomla. The vulnerabilities lie within PHP itself, meaning websites can be exposed even when their content management system (CMS) and plugins are up to date.
PHP's maintainers issued an advance warning on 20 October before publishing the emergency security advisory and fixes the following day. The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were each given a critical severity score of 9.2 out of 10.
Why the vulnerabilities are causing concern
The flaws involve how PHP handles certain server requests and internal memory. Under vulnerable conditions, an attacker could exploit them to execute commands on a server remotely, potentially putting the website and information accessible to it at risk.
PHP's security team says installations processing web requests are at risk, with particular concern about one commonly used Apache server configuration where an attack has been demonstrated before the website's own application code runs. The precise exposure depends on the server setup and whether relevant patches have been applied.
This is different from a security problem confined to one WordPress plugin or Drupal module. A PHP patch generally needs to be installed within the hosting environment, rather than through the website's normal administration dashboard.
Emergency fixes are available
The PHP project has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and is urging users to update immediately. Hosting providers and companies using Linux packages may instead receive equivalent security fixes from their software vendors.
PHP 8.1 and earlier no longer receive routine security releases directly from the PHP project. Some operating system and long-term-support vendors may provide their own backported patches, so businesses using older installations should confirm their position with the provider rather than relying on the version number alone.
PHP's maintainers say temporary precautions can reduce certain routes of attack, but do not fully address the vulnerabilities. Applying a suitable security update remains the recommended solution.
UK warning follows precautionary website shutdowns
The UK's National Cyber Security Centre (NCSC) issued an alert on 21 October, urging companies to identify systems using PHP, prioritise public-facing websites and apply the relevant updates. Where neither a fix nor effective temporary measures can be applied promptly, it says operators should consider taking affected systems offline.
The warning has already had visible consequences. Reuters reported that government websites in the Netherlands and Finland, among others, were temporarily taken offline as a precaution. These shutdowns do not, by themselves, mean the websites had been compromised.
Cloudflare also reported seeing early attacks and introducing temporary firewall measures. It stressed that such protections were not a replacement for installing the PHP fixes.
What website owners should check
For most businesses, the immediate question is whether their hosting provider or technical support team has applied the relevant PHP update. Website owners should ask which version or vendor security fix is running on their live site, whether any associated services are affected and what checks have been completed after updating.
This is particularly important for online shops, booking systems and websites handling customer information. Updates may require compatibility checks, but delaying a critical security fix can leave a website exposed. Businesses should make sure the people responsible for their hosting and website maintenance know who is managing this emergency release.
The PHP fixes are available now. The next step for affected businesses is to obtain confirmation that their live systems have been secured, not simply that an update is planned.
