Patch Your PHP Installation or Take Your Site Offline
Fixes landed on 21 October 2026. Proof-of-concept attack code is already circulating, and at least one national cyber agency took its own site offline rather than wait.
Key points
- Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, let attackers run any code they like on a vulnerable web server with no password or account required.
- Fixed versions were released on 21 October 2026 and cover the four currently maintained PHP branches.
- CERT-EU warned on 21 October 2026 that working proof-of-concept exploit code had already begun to circulate publicly, raising the likelihood of active attacks.
- A third PHP flaw was disclosed on 23 October 2026, but PHP's own team considers it low-risk and will not rush out a separate patch.
- The UK's National Cyber Security Centre (NCSC) told organisations that cannot patch immediately to take affected systems offline.
PHP is the scripting language, meaning a set of instructions a web server runs to build pages on the fly, that quietly sits behind WordPress, Drupal, Joomla and large swaths of shared hosting. Many website owners don't even know their site runs it. That ubiquity is precisely what makes this week's disclosures serious.
What do these vulnerabilities actually do?
Both flaws let an outside attacker run their own code on a web server, no login required. That is the worst category of web vulnerability.
CVE-2026-109618, as described in the NCSC's advisory, works by forcing PHP into an out-of-memory (OOM) condition, which is what happens when software tries to use more memory than the system allows. PHP gets interrupted mid-task while internal data structures are only half-built. When PHP then tries to clean up, it treats that broken data as if it were valid, which can corrupt memory in a way attackers exploit.
CVE-2026-109619 is a use-after-free flaw. Think of it like a shared office: one worker leaves, their desk is cleared, but their notes are still sitting there. A second worker picks them up and acts on stale instructions. In PHP terms, internal state belonging to one web request can survive after its memory has been released, and the next request processed by the same worker may act on that leftover data before normal startup resets it.
CERT-EU's advisory published 21 October 2026 notes both flaws score at the critical level and that proof-of-concept code had already begun to circulate publicly by the time fixes shipped. Cloudflare's chief technology officer said publicly that early attacks were already appearing.
We published a closer look at how quickly those attempts scaled in "PHP2Shell: The Patch Gave Attackers Their Roadmap" on 23 October 2026, which found millions of exploit attempts arriving within hours of disclosure.
What version fixes this, and who needs to act?
Patches covering the four actively maintained PHP branches shipped on 21 October 2026. The table below shows the fixed release for each.
CERT-EU notes the vulnerability chain may affect PHP versions going back as far as PHP 5, which first shipped in 2004. If your hosting provider has not yet updated, ask them directly when they plan to do so.
A third flaw was disclosed on 23 October 2026, but CERT-EU's updated advisory notes PHP considers it low-risk because it only affects sites configured in an unusual way. No emergency out-of-band patch is planned. The mitigation guidance in the existing advisory covers this vector too.
The honest read: already-circulating exploit code combined with PHP's sheer footprint across the web means the window between "patching is optional" and "you've been hit" is short. The Netherlands' national cyber agency took its own site offline rather than run unpatched. That's not theatre.
Should you worry if you don't run a server?
If you manage a server or a hosting account, check your PHP version now and update to the patched release for your branch. Where patching is not immediately possible, the NCSC advises taking the system offline rather than leaving it exposed.
After patching, watch for updates from software that bundles its own PHP copy, particularly control panels and hardware appliances.
If you are a customer of a website rather than its owner, no direct action is needed. The risk here falls on whoever runs the server.
