Critical PHP flaws: update now
PHP released fixes on 21 Oct 2026 for two critical bugs that can allow remote code execution without a login. Here is who is affected and what to do.
How urgent
Act now
Who is affected
Anyone whose website or app runs on PHP, in any version
What to do
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and ask your host which version you run
What happened
On 21 October 2026 the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, both can let an attacker run code on a web server without logging in. The PHP project rates both 9.2 out of 10 on the CVSS v4.0 scale.
The UK National Cyber Security Centre (NCSC) describes them in simple terms. In the first, an attacker can push PHP into running out of memory, and PHP then mishandles half-prepared data when it cleans up after the request. In the second, information from one request can stay in use after its memory was freed, so a later request handled by the same worker can pick it up.
Who is affected
The NCSC says any version of PHP may be affected. It urges organisations on older, unsupported versions to move to a supported release.
- PHP 8.1 and older no longer receive project updates. The PHP project published minimal fixes for 7.4, 8.0 and 8.1 for people who build from source. Otherwise, ask your vendor for a fix or upgrade.
- PHP 8.2 reaches end of life on 31 December 2026.
- Many products include PHP. Watch for updates from their vendors.
What to do
- Find where PHP runs. Start with systems that face the internet, and do not limit the search to old versions.
- Update to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Apply the extra hardening steps the PHP team published. They reduce exposure but do not make an installation safe. The update is the full fix.
- If you cannot update or apply the steps quickly, the NCSC suggests considering taking the system offline.
- If you cannot update or disable a system straight away, check it for signs of compromise and backdoors, with help from an incident response provider if needed.
If you build with AI tools
Our advice, not from the sources: if an AI tool or a template generated your website or back end, check what it runs on. Your hosting panel or your developer can tell you whether PHP is involved and which version. If you are not sure, ask and keep the answer in your records.
Check your PHP version
Type the version your site runs (for example 8.3.30). It runs in your browser; nothing is sent anywhere.
Sources and verification
- UK NCSC: Critical security issue affecting PHP (21 Oct 2026) (opens in a new tab)
- PHP.net: October 2026 security release (21 Oct 2026) (opens in a new tab)
- PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) (opens in a new tab)
- PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) (opens in a new tab)
We use primary sources first and say when we rely on a news report. Dates are the day we last checked each source.
Spotted a mistake? Email [email protected] and we will correct it and note the change.