PHP developers have released urgent security updates to fix two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable servers. The security release, published on October 21, 2026, affects multiple supported PHP versions and has prompted website administrators worldwide to review their systems and apply the necessary fixes.
The announcement also comes with an important admission from the PHP Foundation: early signs of a related security flaw were identified in 2024, but the issue remained unresolved while developers struggled to agree on an appropriate fix. Meanwhile, government websites in Europe and elsewhere went offline as organizations responded to the disclosure.
For businesses, developers, and WordPress website owners, the message is clear: check your PHP version, follow the official security guidance, and install the appropriate updates as soon as possible.
What Happened in the Latest PHP Security Update?
On October 21, 2026, the PHP development team released four security updates addressing two critical vulnerabilities in the programming language.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated attackers to execute code on affected servers under certain conditions. The PHP team strongly encouraged users to update immediately and warned that there were no complete workarounds that could replace installing the fixes.
PHP is widely used to build websites and web applications. Because it powers a large ecosystem of websites, including WordPress installations and numerous business applications, security weaknesses in the language can have consequences far beyond a single organization.
The release addresses two different underlying problems involving PHP’s handling of memory and internal state. Although the technical details differ, both vulnerabilities can create opportunities for remote code execution in affected environments.
Official source: Read the PHP security release announcement for the latest release information and technical guidance.
Which PHP Versions Have Been Updated?
The PHP development team published patched versions for four release branches.
| PHP branch | Patched version |
|---|---|
| PHP 8.5 | PHP 8.5.12 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.2 | PHP 8.2.35 |
These releases address CVE-2026-109618 and CVE-2026-109619. Administrators should confirm which PHP branch their systems use and install the appropriate patched release.
PHP 8.2 also has an approaching end-of-life date: the project has scheduled the end of its support for December 31, 2026. Organizations using this branch should plan a move to a newer supported version rather than relying on it for long-term security updates.
It is important to remember that hosting providers and Linux distributions may distribute PHP security fixes through their own packages. A version reported by the operating system may therefore differ from the upstream PHP version number. Check your provider’s advisory before deciding whether a system is patched.
Why Are These PHP Vulnerabilities Dangerous?
The two vulnerabilities affect important parts of PHP’s internal operation.
According to the PHP Foundation, one vulnerability involves memory corruption associated with an out-of-memory condition. The other involves stale internal state that can cause PHP to access memory that has already been released. Both issues can potentially lead to remote code execution under the right conditions.
Remote code execution is a serious security risk because it can allow an attacker to run commands or code on an affected system without first obtaining legitimate access.
Depending on the server configuration and the permissions available to the compromised process, a successful attack could put website files, application data, and connected services at risk.
However, a vulnerability does not automatically mean that every PHP-powered website has been compromised. Exposure depends on the installed version, configuration, application code paths, and other technical factors.
Website owners should focus on determining whether their installations are affected and applying the official fixes rather than assuming either that every website is vulnerable or that their systems are safe.
Government Websites Go Offline as Organizations Respond
The disclosure triggered a rapid response from organizations responsible for websites and online services.
Reuters reported that government websites in Europe and elsewhere went offline on October 21 as operators worked to protect their systems following the announcement of the critical vulnerabilities.
Taking a website offline can interrupt public services, but it may be a necessary precaution when administrators cannot immediately secure an exposed system.
The United Kingdom’s National Cyber Security Centre also advised organizations to identify systems running PHP, prioritize internet-facing systems, monitor for malicious activity, and apply the security updates when available. It recommended considering taking systems offline if immediate remediation was not possible.
These recommendations highlight the importance of having an incident-response plan before a security emergency occurs.
For organizations running essential services, the challenge is to balance availability with the need to protect systems and sensitive information.
PHP Foundation Acknowledges a Security Concern Dating Back to 2024
One of the most significant aspects of this incident is the history behind the vulnerabilities.
In its October 21 announcement, the PHP Foundation explained that early signs of the memory-related problem were identified in 2024 during work connected with an external security audit.
At the time, a potential exploit had been theorized, but researchers had not found a concrete attack method. Other issues with clearer security implications also competed for attention. Attempts to develop a suitable fix encountered difficult trade-offs involving compatibility, performance, and possible problems for third-party extensions.
The foundation acknowledged that work on the fix had stalled and restarted over a period of months. It described the delay as a structural failure associated with both the security team’s decision-making process and limited resources.
The situation illustrates a difficult reality in software security: identifying a possible flaw is only the beginning. Developers must also establish its impact, reproduce the problem, develop a reliable fix, test compatibility, and coordinate the release across supported versions.
Nevertheless, when a potential vulnerability affects widely deployed software, unresolved security concerns require continued assessment as new evidence emerges.
The PHP Foundation says it has begun changing its security processes, including improving decision-making and strengthening coordination between the security team and foundation leadership. It has also expanded its efforts to support vulnerability triage and code hardening.
Could This Affect WordPress Websites?
Yes, potentially.
WordPress uses PHP to run its core application, themes, and plugins. Consequently, an affected PHP installation may put a WordPress website at risk, depending on the environment and the conditions required to exploit the vulnerability.
However, this does not mean that every WordPress website is compromised or that every installation has the same level of exposure.
Website owners should check their PHP version and contact their hosting provider if they are unsure whether the necessary security patches have been installed.
How to Check Your PHP Version in WordPress
Follow these steps:
- Log in to your WordPress dashboard.
- Open Tools → Site Health.
- Select the Info tab.
- Expand the Server section.
- Find the PHP version listed in the server information.
Compare your version with the official PHP security announcement. If your hosting provider manages PHP updates, ask whether the appropriate security fixes have been applied.
How to Protect Your WordPress Website
Website owners should take the following precautions:
1. Install the appropriate PHP security update.
Ask your hosting provider which patched release applies to your environment. Use a supported PHP version compatible with your website.
2. Back up your website.
Create a recent backup of your website files and database before performing a significant update.
3. Test changes before deploying them.
Where possible, test PHP upgrades in a staging environment to identify compatibility problems with themes, plugins, and custom code.
4. Update WordPress, themes, and plugins.
Keep all components maintained and remove extensions that are no longer required.
5. Review security logs.
Monitor available server logs, security alerts, and malware scans for unusual activity.
6. Investigate possible compromise.
If you suspect unauthorized access, contact your hosting provider or a qualified security professional. Installing a patch does not, by itself, remove malicious code that may already have been introduced.
The PHP Foundation’s guidance is clear that applying the appropriate PHP update is the essential response to these vulnerabilities.
What Should Developers and Hosting Providers Do?
Website security is not the responsibility of individual developers alone. Hosting providers, businesses, software vendors, and infrastructure teams all play a role in protecting PHP-powered services.
Developers should review their environments, identify affected installations, and follow the relevant release instructions. Hosting providers should communicate the availability of security updates and help customers understand whether their systems have been patched.
Organizations operating internet-facing services should also monitor suspicious activity and ensure that security responsibilities are clearly assigned.
The UK’s National Cyber Security Centre recommends identifying PHP installations across an organization’s infrastructure, prioritizing exposed systems, applying security updates, and monitoring for malicious activity.
These measures are particularly important for businesses that operate multiple websites, customer portals, e-commerce platforms, or applications hosted across different environments.
What This Incident Means for the Future of PHP Security
The incident demonstrates how difficult it can be to maintain the security of a programming language used across a large and diverse ecosystem.
The PHP Foundation has explained that the vulnerabilities required substantial technical work and coordination. It also highlighted the need for additional resources and experienced engineers who can investigate complex issues, review fixes, and maintain the security of PHP over time.
The growth of AI-assisted security research is another important development. The foundation says that security researchers and developers are using new tools to identify and investigate vulnerabilities, increasing the importance of effective processes for reviewing reports and delivering fixes.
For businesses, the lesson is straightforward: security cannot be treated as a one-time task. Software needs ongoing maintenance, vulnerability monitoring, and a clear process for applying updates.
Frequently Asked Questions
What are the latest PHP security vulnerabilities?
On October 21, 2026, PHP released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, both could allow unauthenticated attackers to execute code on affected servers.
Which PHP versions contain the fixes?
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should consult their operating system or hosting provider if PHP is managed through third-party packages.
Can these vulnerabilities affect WordPress?
Potentially. WordPress relies on PHP, so websites running affected PHP versions should follow the official security guidance and confirm that the appropriate patches have been installed.
Should I take my website offline?
Not every website needs to be taken offline. However, if your system is affected and you cannot apply the appropriate fix promptly, consult your hosting provider and follow relevant security guidance. The UK National Cyber Security Centre recommends considering isolation of systems where immediate remediation is not possible.
Why is the 2024 discovery important?
The PHP Foundation says early signs of a related flaw were identified in 2024, but a concrete exploitation method had not been established at that time. Technical trade-offs and difficulties in reaching a decision contributed to delays in developing the fix.
Where can I find official PHP security updates?
Visit the official PHP website for release announcements and consult the PHP Foundation’s security report for additional information about the vulnerabilities and the changes to its security processes.
Final Thoughts
PHP’s October 2026 security release is a reminder that vulnerabilities in widely used software can affect organizations across industries and regions.
The four patched releases address two critical vulnerabilities that could allow remote code execution under certain conditions. The reported disruption to government websites also demonstrates the operational challenges organizations face when responding to serious security disclosures.
For WordPress administrators, developers, and businesses, the priority is to identify affected installations, apply the appropriate security fixes, and maintain a reliable process for monitoring future updates.
The PHP Foundation’s acknowledgment of the earlier security concern also highlights the importance of adequate resources, effective decision-making, and continued investment in software security.
If your website runs on PHP, check your installed version today and consult the official security guidance to determine whether you need to take action.
Sources and References
- PHP Development Team — Official Security Releases
Details of the patched PHP versions and the two critical vulnerabilities.
https://www.php.net/ - The PHP Foundation — Today’s PHP Security Release, and How We’re Strengthening PHP Security
Background on the vulnerabilities, the 2024 discovery, the delayed fix, and changes to security processes.
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ - Reuters — PHP Developers Issue Updates to Fix Vulnerabilities, Says Flaw Was Found in 2024
Reporting on the security release and disruption to government websites.
https://www.reuters.com/business/php-programming-language-developers-issue-new-version-fixing-critical-2026-10-21/ - UK National Cyber Security Centre — Critical Security Issue Affecting PHP
Guidance for organizations identifying and protecting PHP installations.
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php - PHP Supported Versions
Official information about PHP support periods and maintained release branches.
https://www.php.net/supported-versions.php
October 23, 2026
Getty Images Files for Chapter 11 Bankruptcy as...
October 23, 2026
