PHP Critical Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What Website Owners Should Do

A new PHP critical vulnerability 2026 has put many websites at risk. On 20 October 2026, the PHP security team warned administrators about two critical flaws. The team then released patches on 21 October 2026. If your website runs on PHP, you should update it now.

What Is the PHP Critical Vulnerability 2026?

The PHP critical vulnerability 2026 affects two bugs, tracked as CVE-2026-109618 and CVE-2026-109619. Each one carries a CVSS v4.0 score of 9.2, which places it in the critical range. Security researchers describe both as remote code execution flaws. This means an attacker could run code on a server without logging in.

Details leaked before the planned disclosure date. Because of this leak, the PHP team moved its release forward by one day.

Which PHP Versions Are Affected by This Vulnerability?

Reports on the affected range are not fully consistent. Some researchers believe the flaw reaches back to PHP 5 and runs through PHP 8. However, the official fixes cover only the currently supported PHP 8 branches. End-of-life versions such as PHP 5 and PHP 7 do not receive an official patch.

The fixed releases are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. Check your version first. On shared hosting, your hosting control panel usually shows it. On a VPS or dedicated server, run php -v in the terminal.

How Dangerous Is the PHP Critical Vulnerability 2026?

Security organizations are treating this issue seriously. Cloudflare’s chief technology officer reported seeing early attacks. Several government websites in Europe went offline as a precaution. Health-ISAC confirmed that large-scale exploitation had not been observed at that point, but it still urged organizations to patch promptly.

Reports also mention exploit tools circulating under the name “php2shell.” Lower technical barriers make attacks easier, so delaying the update increases the risk.

How to Protect Your Website From This PHP Vulnerability

1. Update PHP. Install the latest patch release for your supported PHP version. If you are unsure how, ask your hosting provider or system administrator for help.
2. Check WordPress and plugins. One report states that WordPress automatic updates will not apply this fix. Verify your CMS version and update settings manually.
3. Apply a temporary measure if you cannot update right away. Some security researchers suggest setting session.upload_progress.enabled to Off in php.ini, then restarting PHP services. This is only a stopgap, not a permanent fix. Test your application afterward, because features that depend on upload progress may stop working. You can also restrict access to PHP services at the web server or network level.
4. Review your logs. Look for unusual POST requests, unexpected multipart uploads, and unfamiliar files. If you suspect a breach, take the server offline and call a security professional.

Common Mistakes When Fixing This PHP Vulnerability

Many site owners assume that updating their website code is enough. This flaw sits in the PHP core, below the application layer. Even well-written code remains exposed on an outdated runtime.

Another frequent mistake is assuming that “PHP 8” means the site is safe. The fix applies to specific patch releases, so confirm that you run the latest patch version of your branch.

Final Thoughts on the PHP Critical Vulnerability 2026

Web security requires ongoing maintenance, not a single fix. Regular updates protect websites from attacks like this one. For the official details, read the PHP security advisory on php.net. Then check your PHP version today, apply the patch, and confirm the update with your hosting provider.

Publishing notes: Add a featured image with alt text that includes “PHP critical vulnerability 2026.” Add internal links to your related security guides once you have their URLs. Verify the details against the official PHP advisory and CVE entries before publishing, since this story is still developing.