Technology · Worldwide · Elections hub
PHP rushes out critical security updates for two flaws that could let attackers take over web servers
In brief
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. Both are rated 9.2 out of 10 on the CVSS v4.0 scale. The PHP team says updating is the only complete fix and urges everyone running PHP to update immediately.
What went wrong
PHP is the programming language behind a large share of the web, including many blogs, online shops and content management systems such as WordPress. Both flaws sit deep in the engine, in parts almost every web request touches. The first involves how PHP handles running out of memory: if a request hits PHP's memory limit at exactly the wrong moment, half-prepared internal data can later be treated as valid. The second involves error handling, where internal state from one request can survive into the next request handled by the same worker. According to the PHP Foundation, full remote code execution was demonstrated on Apache with mod_php using default settings, and code execution was also confirmed on PHP-FPM through application code. The PHP team considers mod_php setups the most at risk, but says all installations serving web requests are affected, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
A rushed release after a leak
The release was planned for October 22 but was moved forward by a day after the two CVE numbers began circulating online on October 20 with a wrong severity score. The PHP Foundation said no technical details leaked at first, but a security firm mistakenly published a video of its proof of concept, and copies spread on social media. Canada's Centre for Cyber Security said proof-of-concept code is available but that it had not seen active exploitation as of October 21, adding that this "can change quickly". PHP 8.1 and older no longer get official updates, although the PHP security team published minimal patches for PHP 7.4, 8.0 and 8.1 for people who build from source.
What to do
If you run your own server, update PHP to one of the fixed versions or install your Linux distribution's updated package, then restart PHP. If you use shared hosting or a managed WordPress plan, check your host's status page or dashboard; most hosts patch PHP for you, but you may need to move an old site off PHP 8.1 or earlier. The PHP team lists some temporary settings that reduce exposure, but says they do not make an installation safe.
VSH take: this is the rare security story that affects ordinary people who just run a small blog or shop, so it is worth a five-minute check today. If you keep a site, note the PHP version your host shows. ViralScopeHub itself is a static site and does not run PHP. For everyday digital safety, our password generator makes strong passwords, and our guide to removing location data from photos covers another easy privacy win.
This is our own summary of PHP's security advisory, the PHP Foundation's blog and the Canadian Centre for Cyber Security alert. ViralScopeHub is not affiliated with the PHP project or the PHP Foundation.
Why it matters
PHP runs a large part of the web, so a flaw that lets attackers run code without logging in puts countless small sites, shops and services at risk until they update.
People also ask
Which PHP versions fix the problem?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026.
Am I affected if I just visit websites?
No action is needed by visitors. Site owners and hosting providers need to update PHP on their servers.
What about PHP 8.1 or older?
They no longer receive official updates. Check with your Linux distribution or long-term support vendor for backported fixes, or upgrade to a supported version.
Related free tools: Password Generator, Percentage Calculator
Sources
- PHP.net: Security advisory: Critical remote code execution vulnerabilities, update now
- The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
- Canadian Centre for Cyber Security: AL26-026 - Critical vulnerabilities impacting PHP
Every ViralScopeHub news item is an original summary written in our own words. We link to the original reporting so you can read the full story from the publisher.
