Critical PHP Security Alert: Two Vulnerabilities Put Web Servers at Risk

Published: October 22, 2026 | Category: Cybersecurity

What Happened?

The PHP development team has released urgent security updates to address two critical vulnerabilities that could allow attackers to execute malicious code remotely without authentication.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP installations serving web requests. Websites and applications running PHP may be at risk if their servers have not received the required security patches.

Which PHP Versions Are Affected?

The security advisory identifies the following fixed releases:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

Earlier versions in these release branches require updating. PHP 8.1 and older versions are also affected, but they no longer receive standard upstream security updates. Administrators should consult their Linux distribution or hosting provider for available backported fixes, or migrate to a supported PHP release.

Why Is This Security Issue Serious?

Remote code execution vulnerabilities can allow attackers to run unauthorized commands on a vulnerable server. Depending on the server's configuration and permissions, this could lead to data exposure, website compromise, service disruption, or further attacks.

The PHP security team has warned that there is no complete workaround for these issues: installing a fixed release is the recommended solution.

How to Protect Your Website

Website owners and system administrators should take the following steps:

1. Check your PHP version: Run php -v on your server, and verify the PHP version used by your actual website.

2. Back up your website: Secure your files, databases, and configuration before upgrading.

3. Install the security update: Use the appropriate patched package for your operating system and PHP environment.

4. Restart the relevant service: If required, reload or restart PHP-FPM, Apache, or the service managing your PHP installation.

5. Test your applications: Check website functionality, logs, database connections, and critical features after the update.

6. Review security logs: Look for suspicious requests, unexpected processes, modified files, and unusual server activity.

Updating WordPress, Laravel, PrestaShop, or another PHP application alone does not patch a vulnerable PHP runtime.

Final Recommendation

Treat this advisory as a high-priority security issue. Administrators should identify affected systems, apply the appropriate security updates, and verify that their websites are running a patched PHP version.

Official reference: PHP Security Announcements

Keep your PHP environment updated to reduce the risk of server compromise and protect your website and customer data.