The PHP development team has released security patches to address two critical vulnerabilities that could allow attackers to execute malicious code on affected web servers without authentication.
Published on 21 October 2026, the patches address vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. Both have been rated 9.2 out of 10 under the Common Vulnerability Scoring System, indicating a critical level of severity. (Official PHP security advisory)
PHP is a widely used programming language that powers websites and web applications, including platforms such as WordPress, Drupal and Joomla. As a result, vulnerabilities affecting PHP can have implications for organisations running a wide range of websites and online services.
WHAT ARE THE LATEST PHP VULNERABILITIES?
The two vulnerabilities relate to how PHP manages memory and internal processes when handling requests. If successfully exploited, they could allow an unauthenticated attacker to execute code remotely on an affected server.
The UK’s National Cyber Security Centre (NCSC) has urged organisations to identify systems running PHP, prioritise those accessible from the internet and prepare to apply the available security updates. Read the NCSC’s security alert for further guidance.
The NCSC has also advised that, where immediate remediation is not possible, organisations should consider taking affected systems offline until the risks can be addressed.
WHICH VERSIONS ARE AFFECTED?
The vulnerabilities affect PHP installations running web requests. Security patches have been released for supported versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Organisations running earlier versions should check the official guidance to establish the appropriate upgrade path. PHP versions 8.1 and older are no longer supported by the PHP project and do not receive its security updates.
The vulnerabilities are not limited to WordPress websites. Any web application running an affected PHP installation may be at risk, depending on its configuration and environment.
WHAT COULD THE IMPACT BE FOR BUSINESSES?
If exploited, these vulnerabilities could allow attackers to execute malicious code on affected servers or access sensitive information held in memory. This could potentially lead to compromised websites, unauthorised access to data, service disruption and further security issues.
The impact may extend beyond websites built directly on PHP, as some third-party platforms and services also rely on it behind the scenes. Organisations should therefore check their website infrastructure and any relevant software dependencies, rather than assuming their website is unaffected based on its visible platform alone.
The PHP development team has released security patches to address the vulnerabilities, and organisations are being urged to identify affected systems and apply the relevant fixes promptly.
WHAT SHOULD ORGANISATIONS DO NEXT?
The PHP development team is urging users to update immediately. Organisations should identify where PHP is running across their infrastructure, check with their hosting providers or technical teams, and apply the relevant security updates as soon as possible.
Businesses should also monitor affected systems for suspicious activity and keep track of further guidance from PHP and relevant software providers.
The announcement highlights the importance of keeping website infrastructure and software up to date as new vulnerabilities are identified and security fixes become available.
Regular website maintenance helps keep software up to date and address potential security issues, reducing the risk of vulnerabilities being left unresolved. Find out more about our website maintenance and hosting services.
FOUND THIS USEFUL?
Add EDGE Creative as a preferred source on Google to stay up to date with our latest insights, advice, and expertise across SEO, digital marketing, and AI search.