PHP Security Update: Critical Flaws to Patch Now
A PHP security update fixes two critical flaws that attackers are already exploiting. See which versions are safe and what a website owner should do now.
Updated: 27 October 2026
The PHP security update released on 21 October 2026 fixes two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a server without logging in. If your website runs on PHP, which includes most WordPress, Joomla, Drupal, Magento and Laravel sites, you need to confirm that your hosting is on a patched version.
Reports say attackers started trying the flaw before the public release, so waiting weeks is risky. This guide explains what happened, which PHP versions are fixed, and the simple steps a business owner can take today, even without a technical team.
What are the new critical PHP vulnerabilities?
The PHP security team announced an urgent release for 21 October 2026 and rated two flaws 9.2 (Critical) on the CVSS v4.0 scale. Help Net Security describes CVE-2026-109618 as remote code execution through out-of-memory corruption, where cleanup code can treat half-built request data as valid. CVE-2026-109619 is described as remote code execution through stale global state, where a later request on the same worker may use leftover data.
Patchstack says the flaws sit in the PHP interpreter itself, so a site can be exposed whatever plugins or themes it uses. Hackaday reports that a single request without login can trigger the attack before any application code runs.
Are these PHP flaws being exploited already?
Yes, according to the sources we read. Help Net Security reports that Amazon's honeypot recorded an exploitation attempt on 17 October, four days before disclosure, and Hackaday says details leaked about a day before the planned embargo, so patches came out early.
Patchstack reports that hosting partners have seen multiple active exploitation incidents, while its own data showed mostly probing at the time of writing. Treat that as a reason to move quickly, not a reason to relax.
Which PHP versions have the fix?
The upstream fixed versions are listed below. Help Net Security adds that the PHP team also released source backports for PHP 7.4, 8.0 and 8.1, meant for people who build from source or have no long-term-support vendor.
PHP 8.1 and older are no longer supported upstream. Patchstack notes that some vendors, such as Debian and Ubuntu package maintainers, AlmaLinux and CloudLinux, have backported patches, so check your hosting provider's changelog.
- PHP 8.5: fixed in 8.5.12
- PHP 8.4: fixed in 8.4.27
- PHP 8.3: fixed in 8.3.36
- PHP 8.2: fixed in 8.2.35, and Patchstack says 8.2 gets security fixes only until 31 December 2026
Is my WordPress or business website affected?
Any site that runs on a vulnerable PHP version is exposed. Patchstack lists WordPress, Drupal, Magento, Joomla and Laravel sites as examples. Help Net Security says this covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed setups.
If you use shared or managed hosting, the provider normally applies the update, but you should still ask when they will do it. If you run your own server or container, you must update it yourself.
What should a small business owner do today?
You do not need to read exploit details. Work through this short checklist, and pass it to whoever manages your website or hosting.
- Find your PHP version. In WordPress, open Tools, then Site Health, then Info, then Server.
- Ask your host in writing whether the patched PHP version is installed, and when.
- Update to a patched version or your vendor's patched package. Patchstack says only an update is a complete fix.
- Do not install random fix plugins or paste snippets from unknown websites, and avoid running public proof-of-concept bundles.
- If you cannot patch yet, the UK NCSC urges taking an unfixable system offline, as reported by Help Net Security. Cloudflare's firewall rules are only a stopgap, not a substitute for patching.
- Watch for warning signs such as repeated HTTP 500 errors, memory-limit errors or unexplained server restarts. If you see them, treat the server as possibly compromised and change passwords and API keys stored on it.
Why does this matter even if my site looks normal?
Patchstack warns that the flaws can expose memory contents such as passwords, tokens and API keys, and that application logs may show little. A site can look normal while secrets are being read.
Hackaday quotes Amazon's advice to measure your patch window in hours, not weeks, and to investigate from the earliest exploitation date, not the disclosure date. For a business, that means checking activity from about 17 October onward if you suspect a problem.
Confirm your PHP version, get your host to install a patched release, and plan to leave PHP 8.1 or older. The rules and version numbers may change as vendors publish more advice, so check your host's and the PHP project's latest notices.
Frequently asked questions
Which PHP version should I update to?
The fixed upstream versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you are on 8.1 or older, ask your host for a vendor backport or plan an upgrade to a supported version.
Do I need to update PHP if I use WordPress?
Yes. The flaws are in PHP itself, so a WordPress site on a vulnerable PHP version is exposed whatever plugins it uses. Check your PHP version in Site Health and ask your host to patch it.
How do I check my PHP version in WordPress?
Go to Tools, then Site Health, then the Info tab, and open the Server section. It shows the PHP version your site is running.
Is a firewall enough to protect my site from these PHP bugs?
No. Cloudflare has added initial firewall rules, but sources describe them as a stopgap. Only updating PHP fully fixes the problem.
Sources
- Help Net Security: A critical PHP security release is coming today (helpnetsecurity.com)
- Help Net Security: PHP2Shell vulnerabilities patched (helpnetsecurity.com)
- Patchstack: Major security alert, PHP vulnerable to critical RCE (patchstack.com)
- Hackaday: This Week in Security (hackaday.com)
This article is based on the sources above and was current on 27 October 2026.
Need help turning this into results for your business? Talk to the Knight21 team or see our software, AI and digital marketing services.