Cybersecurity · Technology · Public services

PHP Releases Emergency Fixes for Two Critical Remote-Code Flaws

The PHP project says the vulnerabilities can let an unauthenticated request run code on a server. Four fixed releases are available, and temporary mitigations are not a complete solution.

By Health Politics Daily News Desk · October 21, 2026 at 10:00 a.m. ET

The PHP development team released emergency updates on October 21 for two critical vulnerabilities that can allow unauthenticated remote code execution. The fixed project releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

That is a server-side risk: successful exploitation could let an attacker run unauthorized code on a vulnerable system. It does not mean every site using PHP has been compromised, and ordinary visitors cannot determine a site’s patch status from its appearance.

What PHP has verified

PHP’s October 21 security advisory identifies CVE-2026-109618, involving out-of-memory handling and partially initialized request data, and CVE-2026-109619, involving internal state that can remain after its backing memory has been freed. Both paths can lead to remote code execution.

The project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It describes the risk as highest for mod_php because researchers demonstrated an attack that can trigger before application code runs.

Who needs to act

The audience for the technical response is website owners, hosting companies and administrators—not typical website visitors. Administrators should identify the PHP runtime actually serving each application and apply a vendor or distribution package that contains the fixes. Updating WordPress, Drupal or another content-management application by itself does not update the server’s PHP runtime.

PHP 8.1 and older no longer receive regular updates from the project. Some operating-system or long-term-support vendors may backport the fixes, so the correct package name and version can differ from the four upstream release numbers. The project also published minimal source backports for PHP 7.4, 8.0 and 8.1 for operators without vendor coverage.

Why temporary safeguards are not enough

PHP lists configuration changes that may reduce exposure to known paths, including disabling session upload progress and adjusting memory or request-size limits. Its advisory explicitly says only an update is a complete solution. A web-application firewall can block known exploit patterns but cannot prove that every route to the underlying memory-safety failures is covered.

The United Kingdom’s National Cyber Security Centre advised organizations that cannot remediate immediately to consider taking affected systems offline until they can be fully mitigated. That decision is operational and risk-specific; this report does not substitute for an organization’s incident-response process.

What happened before the fixes arrived

Reuters reported that government agencies in the Netherlands and Finland took websites offline as a precaution and that security providers saw early attack activity. A precautionary shutdown is evidence of risk management, not proof that the disconnected site had been breached.

The broad reach matters because PHP runs behind many content-management systems, shops and public-service portals. But estimates of how much of the web uses PHP depend on measurement methods, and a technology’s prevalence does not reveal how many installations were exposed, patched or exploited.

What remains uncertain

Verified fact: PHP has disclosed two critical flaws and shipped fixes for supported branches. Analysis: the short time between public technical details and patch availability raises the likelihood of automated scanning, while the real-world impact depends on patch speed, configuration and attacker capability.

Forecast: security teams will probably continue finding exposed legacy installations and attempted exploitation over the coming days. That is an informed expectation, not a confirmed breach count. Opinion: Health Politics Daily takes no position on any vendor; the useful standard is whether operators can verify that the runtime serving requests contains the fix.

For related context, see our coverage of the new U.S. dating-app fraud-alert law and the state lawsuits over alleged ChatGPT harms.

Principal sources

• PHP: security advisory and fixed releases
• UK National Cyber Security Centre: remediation guidance
• CERT-EU: critical PHP vulnerabilities advisory
• Reuters: government shutdowns and early attack reports

No directly relevant official or publisher-authorized video with clearly verified embedding permission was available at publication, so none was included.