Critical PHP Vulnerability Alert: Two Security Flaws Could Allow Remote Code Execution

PHP developers have released urgent security updates after identifying two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable servers without logging in. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect multiple PHP versions and may put websites and web applications at risk. The PHP development team released patched versions on October 21, 2026, and recommends that administrators update affected systems immediately.

What are the two PHP security vulnerabilities?

PHP is a server-side programming language used to build websites and web applications. It powers many content management systems, online stores, business websites and other internet services.

The latest security alert concerns two separate flaws in PHP’s internal processing. Both have a CVSS v4.0 severity score of 9.2, which places them in the critical category.

1. CVE-2026-109618: Out-of-memory corruption

The first vulnerability is linked to how PHP handles memory allocation failures.

Under certain conditions, PHP can encounter a memory-related error while internal request data is only partially initialized. The software may then incorrectly process that data during request cleanup.

This can corrupt internal memory and create an opportunity for an attacker to execute malicious code on a vulnerable server.

The risk is particularly serious for certain Apache configurations using mod_php. The PHP team reported a demonstrated attack that could trigger the problem before the website’s application code runs.

2. CVE-2026-109619: Stale global state

The second vulnerability involves internal PHP state that can remain linked to memory after that memory has been released.

In certain situations, a previous request can leave behind an invalid reference. A subsequent request handled by the same worker may access that stale reference before PHP has properly initialized the new request.

This type of memory-management error is known as a use-after-free vulnerability. Depending on the circumstances, it can lead to remote code execution or other serious security problems.

Which PHP versions are affected?

The PHP security advisories identify the following affected version ranges and fixed releases.

Important: PHP 8.1 and older versions are no longer supported by the main PHP project. Some Linux distributions and long-term support providers may offer backported security fixes. Website owners should confirm the status of their specific installation with their hosting provider.

PHP 8.2 is also approaching its scheduled end of security support on December 31, 2026. Although version 8.2.35 fixes these vulnerabilities, administrators should plan to move to a newer supported branch.

Why is this PHP vulnerability a serious concern?

Remote code execution, commonly called RCE, is one of the most serious classes of software vulnerability.

If an attacker successfully exploits an affected PHP installation, the consequences may include:

• Unauthorised code execution: An attacker could potentially run malicious commands within the privileges available to the vulnerable service.

• Exposure of sensitive information: Depending on the system’s configuration, information held in application memory or accessible files could be at risk.

• Website compromise: Attackers may attempt to modify website files, create unauthorised access or interfere with normal operations.

• Potential database exposure: If the compromised service has access to a database, its permissions and credentials may affect the extent of the damage.

• Service disruption: Exploitation could also affect the stability or availability of a website or application.

These are potential consequences, not evidence that every vulnerable website has been compromised. The actual impact depends on the PHP deployment, server permissions, application configuration and whether exploitation succeeds.

The concern is not limited to websites that developers identify as custom PHP projects. PHP may run underneath popular platforms and other software products. Security researchers have demonstrated proof-of-concept exploitation involving products that integrate PHP, including WordPress, Drupal and Joomla. This does not mean every installation of those platforms is vulnerable; the PHP runtime and deployment must also be considered.

Have attackers started exploiting the PHP vulnerabilities?

Security researchers have demonstrated that the vulnerabilities can be exploited under certain conditions. That makes prompt patching important, even for organisations that have not detected an attack.

In reporting published on October 21, Reuters said the US Cybersecurity and Infrastructure Security Agency (CISA) had not observed exploitation at the time of its advisory. However, that was a time-specific assessment, not a guarantee that attacks would not occur later.

Website administrators should therefore avoid waiting for reports of widespread attacks before taking action.

How to protect a website from the PHP vulnerability

The PHP development team has released fixed versions. Installing an appropriate security update is the primary action website owners should take. The official PHP guidance states that updating is the only complete remediation for these vulnerabilities.

1. Check the PHP version running on your website

First, establish which PHP version your website actually uses.

You can usually find this information in your hosting control panel. If you use WordPress, check the PHP version shown under Tools → Site Health → Info, or contact your hosting provider.

Developers with server access can also run:

php -v

This command shows the PHP version available to the command-line environment. However, that version may differ from the PHP runtime serving website requests. Confirm the web-facing version before deciding that your website is protected.

2. Install the appropriate security update

Upgrade to the relevant fixed release listed in the version table above.

The exact process depends on your hosting environment:

• Shared hosting: Contact your hosting provider or use its PHP version management tools.

• VPS or dedicated servers: Apply the relevant security update through the operating system’s package manager or supported PHP installation method.

• Cloud and container environments: Update the relevant PHP packages, container images or managed runtime.

• Managed hosting: Ask the provider to confirm that the PHP runtime serving your website has been patched.

Back up important website files and databases before making significant infrastructure changes. Test the updated environment where practical, and restart or reload affected services when required to ensure they use the patched runtime.

3. Do not rely only on WordPress or plugin updates

Updating WordPress core, themes and plugins is important for general security. However, those updates do not necessarily update the PHP interpreter running on your hosting server.

If your website uses WordPress, confirm that the underlying PHP runtime is also patched. The same principle applies to Drupal, Joomla and custom PHP applications.

4. Identify PHP bundled with third-party software

Some applications, appliances, containers and commercial products include their own PHP components.

Organisations should check their software inventory and consult vendors to establish whether bundled PHP installations require an update. Updating the system’s main PHP installation may not fix a separate bundled runtime.

5. Restrict exposure if you cannot patch immediately

If an affected, internet-facing system cannot be updated promptly, assess whether it can be isolated from public networks until a fix is applied.

A web application firewall, stricter request filtering or other temporary controls may reduce some risks, but they should not be treated as a complete replacement for the security update. Follow the PHP advisory and your hosting provider’s instructions.

6. Check for signs of a possible compromise

After patching, review relevant security logs if your website was running a vulnerable version, especially if it handles sensitive information or is exposed to the internet.

Look for unusual PHP processes, unexpected commands, unfamiliar files, suspicious account changes or unexpected outbound network connections. Review web server, application, authentication and endpoint logs where available.

If you find evidence of a possible compromise, investigate it separately from patching. Updating PHP prevents exploitation of these specific flaws in the patched runtime, but it does not automatically remove malicious files or reverse changes made before the update. Consider professional incident-response assistance if the website or its data may have been compromised.

What does the PHP security alert mean for WordPress website owners?

WordPress users should pay attention because PHP commonly runs behind their websites. Nevertheless, the important question is not simply whether a website uses WordPress. It is whether its server-side PHP runtime is affected and has received the appropriate security fix.

Website owners should:

1. Check the PHP version reported by their hosting provider.

2. Confirm that the provider has applied the relevant security update.

3. Check whether any separate PHP runtimes or bundled applications are present.

4. Keep WordPress core, themes and plugins updated as an additional security measure.

5. Review backups, access controls and security logs if the website was exposed while vulnerable.

If you cannot manage PHP directly, ask your host to confirm the exact patched version and whether all website-serving workers have been updated.

Frequently asked questions

Is the latest PHP vulnerability fixed?

Security updates were released on October 21, 2026. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should install the appropriate supported release or confirm that their vendor has supplied an equivalent security fix.

Can the PHP vulnerability be exploited without logging in?

Yes. The reported vulnerabilities can allow remote code execution without authentication under certain conditions. The precise attack requirements depend on the PHP deployment and vulnerability involved.

Does updating a WordPress plugin fix the problem?

Not necessarily. These vulnerabilities affect PHP itself. Updating a plugin does not automatically patch the PHP runtime managed by the hosting server.

What should website owners do if their hosting provider has not released a fix?

Contact the provider immediately and request a confirmed remediation plan. For exposed systems that cannot be patched promptly, consider isolating them from public networks until they can be secured. Do not assume that a firewall or other temporary control fully resolves the problem.

Are PHP 8.1 and older versions affected?

Yes. The PHP project no longer supports PHP 8.1 and older branches, although some vendors may provide backported fixes. Website owners should check with their operating system or hosting provider and plan to migrate to a supported PHP release.