Critical Security Vulnerabilities Discovered in PHP!

Two critical security vulnerabilities discovered in PHP's core infrastructure are posing a serious security risk to websites and servers worldwide. Announced on October 21, 2026, the vulnerabilities could allow attackers to execute code remotely on affected systems without authentication. PHP developers have released security updates and are urging system administrators to update their installations without delay.

Two Critical Security Vulnerabilities Identified

In its security advisory, the PHP team disclosed two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, both vulnerabilities could allow attackers to execute unauthorized code on a server.

The first vulnerability is associated with memory corruption that can occur when PHP handles out-of-memory conditions. The second stems from the potential reuse of internal data during a request after the associated memory has already been released.

If successfully exploited, these vulnerabilities could allow attackers to perform operations within the privileges of the PHP process, access sensitive information, or compromise the security of affected applications. The risk is not limited to a particular content management system; various web applications running PHP may also be affected.

Which PHP Versions Are Affected?

According to the security advisories, PHP installations processing web requests may be at risk. Different execution configurations, including PHP-FPM, Apache mod_php, php-cgi, and LiteSpeed, should also be assessed.

The following versions include the fixes released by the PHP team:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

Systems running earlier versions of these releases should be updated. PHP 8.1 and older versions that have reached end of life may no longer receive standard security updates. Administrators should therefore check whether their distribution provider offers patches or plan a migration to a supported version.

Given PHP's widespread use, these vulnerabilities are also relevant to servers hosting WordPress, Joomla, Drupal, and other PHP-based systems. However, this does not mean that every website faces the same level of risk. The PHP version, execution configuration, and application environment all influence the actual exposure.

What Should System Administrators Do?

Server administrators should first identify the PHP versions running across their infrastructure and prioritize systems accessible from the internet.

Key security measures include:

• Upgrade PHP installations to versions containing the security fixes.

• Check the versions and update status of PHP installations through cPanel, WHM, and other hosting control panels.

• If using operating system packages or third-party repositories, review the security patches provided by the relevant vendor.

• Check system logs before and after updating to investigate potential signs of unauthorized access.

• If an immediate update is not possible, apply the temporary mitigations described in the official security advisories. If adequate protection cannot be ensured, consider temporarily isolating exposed services from the internet.

It is also important to note that checking the PHP version number alone may not be sufficient. Some Linux distributions backport security fixes to their existing packages. Administrators should therefore verify whether the installed package has already been patched by its vendor.

Delaying security updates on servers hosting PHP-based applications can create risks that extend beyond a single application and affect a broader infrastructure. This is particularly important in shared hosting environments, where multiple websites run on the same server. Maintaining an inventory of PHP versions and implementing a structured update process are essential security practices.

PHP developers have released security updates addressing the two reported critical vulnerabilities and are urging users to update as soon as possible. Server administrators should follow official advisories, verify their installed packages, and inspect their systems after applying updates.

In conclusion, these PHP security vulnerabilities once again highlight the importance of regular patch management across web infrastructure. Version checks and security updates should not be postponed on servers running PHP.