Summary: On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. If an attacker exploits them, they can run code on your web server without logging in, which is enough to steal customer data, plant hidden backdoors, or take your site offline. PHP is used by about 69% of websites whose server-side language is known, and by more than half of U.S. .gov sites where it’s known, and WordPress alone powers nearly 40% of all websites. If your site runs on PHP, and every WordPress site does, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution’s patched package) now.

What happened

The PHP project patched every supported branch on October 21. Both flaws sit in code nearly every request touches:

  • CVE-2026-109618 (memory corruption when PHP runs out of memory): if a request hits PHP’s memory limit at the wrong moment, PHP can leave half-built internal data behind and later treat it as valid.
  • CVE-2026-109619 (stale global state): internal data from one request can outlive its memory, so a later request handled by the same worker can use that freed memory.

What an attacker could do with this

These are “unauthenticated remote code execution” (RCE) flaws. In plain terms, a stranger could make your server run any code they choose, with your website’s own access. This class of flaw allows an attacker to:

  • Steal data: customer records, contact-form submissions, and the order and payment details your site handles.
  • Take over your database: read wp-config.php for your database password and copy the whole database.
  • Stay hidden: install backdoors and web shells that survive later updates, so they can return after you patch.
  • Turn your site against your visitors: deface pages, redirect visitors to scam sites, inject SEO spam, or hide card skimmers on checkout pages.
  • Abuse your server: send spam or phishing, join botnets and DDoS attacks, or mine cryptocurrency. That can get your IP blacklisted and your email blocked.
  • Spread further: use your server as a foothold to reach other sites on the same server or other systems on your network.
  • Destroy or ransom: encrypt or delete your site and its data.

For a business, that can mean downtime and lost sales, Google “deceptive site ahead” warnings, breach-notification and compliance obligations, cleanup costs, and lost customer trust that takes far longer to rebuild than a server.

Why this pair is especially serious:

  • No login is needed.
  • Both are rated 9.2 (critical) on the CVSS v4.0 scale.
  • On Apache with mod_php, the attack can start before any website code runs, so security plugins never see it.
  • Proof-of-concept code is circulating. According to the PHP Foundation, it spread after details leaked shortly before the release, although the PHP security team found no working exploit at release time.
  • CISA wants these patched immediately. The US Cybersecurity and Infrastructure Security Agency (CISA) calls the pair “php2shell” and urges immediate patching. When it published its alert, CISA had not seen exploitation.

The scale is huge. As of October 22, 2026, W3Techs reports that PHP is used by 69.3% of websites whose server-side language it can identify, and that WordPress runs on 39.6% of all websites. Government is no exception: PHP is used by 53.1% of .gov sites whose server-side language W3Techs can identify, and WordPress (32.5%) and Drupal (10.1%) are among the most common content management systems on .gov sites where the CMS is known. These figures show where PHP is in use, not where it’s vulnerable. Patched sites aren’t at risk; unpatched ones are.

Who is affected

According to php.net and CISA, all PHP installations serving web requests are at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. If you run WordPress, WooCommerce, Drupal, Joomla or any other PHP application, assume you’re affected until you’ve checked your version.

How to check your PHP version

  • WordPress: go to Tools > Site Health > Info > Server to see the exact version, for example 8.4.27.
  • Hosting panel: check your site settings. In cPanel, look for “Select PHP Version” or “MultiPHP Manager.”
  • Your own server: run php -v, but confirm in Site Health or phpinfo(), since the command-line version can differ from the web server’s.

How to fix it

Managed hosting. On many managed platforms you choose the PHP branch (8.3, 8.4, and so on) and the host applies the patch releases. Check with your host that you’re on a patched version, or ask when the patch will arrive.

Your own Ubuntu or Debian server. Install your distribution’s PHP security updates, then restart PHP-FPM and/or Apache so the fixed code is loaded. Check the package version, not the PHP number: for example, Ubuntu 22.04 needs php8.1 8.1.2-1ubuntu2.28 or later (USN-8948-1), and Debian 13 needs php8.4 8.4.27-1~deb13u1 or later (DSA-6574-1). If your PHP comes from a third-party repository such as ppa:ondrej/php or packages.sury.org, distro advisories don’t apply; check that repository’s changelog.

On PHP 8.1 or older? The PHP project no longer releases updates for these versions, and PHP 8.2 joins them after December 31, 2026. Some vendors have backported the fix anyway: Remi’s repository shipped PHP 7.4 build 7.4.33-31 with it on October 21. If you’re stuck on an old version, check whether your vendor has shipped one, but treat it as a stopgap. The real fix is a supported branch, and CISA advises taking systems offline if they can’t be patched. Before switching, take a full backup, update plugins and themes, and test on staging if you can.

If you can’t update right away, php.net lists temporary mitigations and CISA notes a web application firewall may help, but neither replaces the update.

Don’t wait on this one

Recovering from a compromised server costs far more than preventing it. SetIT Solutions can check your PHP version today, apply the patch, look for signs of compromise, and plan a safe move off unsupported PHP with backups and testing. Contact us and we’ll get your site secured.

Sources

Tags:
Social: