PHP is one of the most widely used programming languages for web development. It powers websites, content management systems, e-commerce platforms, APIs, and many business applications. Because so many online services depend on PHP, security vulnerabilities in the language can have a significant impact on website owners and developers.

On October 21, 2026, the PHP development team announced critical security updates addressing two vulnerabilities that could allow attackers to execute code remotely without authentication. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have prompted urgent warnings from security organizations and technology providers.

This article explains what happened, why it matters, which systems may be affected, and what developers and server administrators should do to protect their websites.

Read more about PHP2Shell and the critical PHP flaws prompting precautionary site shutdowns 

What Happened to PHP in October 2026?

The PHP development team released emergency security updates after researchers identified two critical vulnerabilities affecting PHP installations that process web requests.

These vulnerabilities are particularly concerning because successful exploitation could allow an attacker to execute malicious code on a vulnerable server. Depending on the server’s configuration and permissions, this could expose sensitive information, compromise applications, or disrupt services.

The vulnerabilities have been associated with the name PHP2Shell in security reporting. Cloudflare also reported deploying web application firewall protections to help defend against exploitation attempts.

Security advisories indicate that PHP versions before the corrected releases may be vulnerable. Organizations using PHP in production environments should therefore review their installations and apply the appropriate security updates immediately.

Understanding the Two Critical Vulnerabilities

The two vulnerabilities have different technical causes, but both can create serious security risks.

1. CVE-2026-109618: Memory Corruption

The first vulnerability involves problems with memory handling during out-of-memory conditions. Under certain circumstances, internal request data may not be fully initialized before cleanup operations occur.

This can cause the runtime to handle invalid data incorrectly, potentially opening a path to remote code execution.

For website owners, the important point is that a vulnerability in the PHP runtime itself may affect an application even when its business logic appears secure.

2. CVE-2026-109619: Stale Global State

The second vulnerability concerns internal state that can remain accessible after the memory supporting it has been released.

Improper handling of this state can cause unsafe memory access and may allow an attacker to interfere with the PHP process.

Both vulnerabilities have been assigned a CVSS v4.0 severity score of 9.2, placing them in the critical category. Administrators should not assume that a secure application automatically protects an outdated PHP runtime.

Which PHP Versions Are Affected?

According to the official PHP security announcements, patched releases are available for the following supported branches:

PHP branch	Security-fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Older versions, including PHP 8.1 and earlier, are also identified as affected, but some are no longer supported and do not receive security fixes.

If your server runs an affected version, upgrade to the appropriate patched release or migrate to a supported PHP branch. Always verify compatibility with your application, hosting environment, and required extensions before upgrading.

For the latest details, consult the official PHP security announcements.

How Could This Affect Websites?

PHP vulnerabilities can have consequences for websites and online services across multiple industries.

Website downtime: Administrators may temporarily restrict access or disable vulnerable services while applying emergency patches.

Data exposure: A compromised server could expose database credentials, customer information, configuration files, or other sensitive data, depending on the attacker’s access.

Application compromise: Remote code execution may allow attackers to run malicious commands, modify files, or establish unauthorized access.

Business disruption: Security incidents can interrupt customer transactions, internal operations, and website availability.

Increased security workload: Development and infrastructure teams may need to investigate logs, update servers, verify application integrity, and rotate credentials.

These risks do not mean that every PHP website has been compromised or that PHP itself is experiencing a universal outage. They mean that vulnerable installations require urgent attention.

What Should Developers and Server Administrators Do?

The following steps can help reduce exposure.

1. Check Your Installed PHP Version

Run this command on a server or development machine where PHP’s command-line interface is installed:Plain Text

php -v

Compare the reported version with the official security-fixed releases.

Remember that the command-line version may differ from the version used by your web server. Check PHP-FPM, Apache, LiteSpeed, containers, and other relevant runtime environments separately.

2. Install the Security Update

Upgrade to the appropriate patched release for your PHP branch.

For managed hosting, contact your hosting provider if you cannot change the PHP runtime yourself. For containerized applications, update the base image and rebuild and redeploy the affected containers.

Do not assume that restarting a service or changing an application setting is equivalent to installing the security fix.

3. Review Your Server Configuration

Identify all publicly accessible services that process PHP requests. Pay particular attention to older installations and configurations that are difficult to update.

Remove unused PHP deployments and ensure that production systems do not rely on unsupported runtime versions.

4. Review Logs for Suspicious Activity

Inspect web server, PHP, application, and security monitoring logs for unusual requests, unexpected errors, unfamiliar processes, or unauthorized file changes.

If you discover evidence of exploitation, follow your incident response procedures. Updating PHP alone may not remove malware or reverse changes made during a successful attack.

5. Protect Credentials and Sensitive Data

If a server may have been compromised, assess whether database passwords, API keys, session secrets, and other credentials could have been exposed.

Rotate affected credentials from a trusted environment, review access permissions, and investigate any unexpected account or configuration changes.

6. Maintain a Reliable Update Process

Regular patch management, automated monitoring, tested backups, and a documented recovery plan can help organizations respond more quickly to future vulnerabilities.

Security updates should be treated as an ongoing operational responsibility rather than an occasional maintenance task.

Is PHP Experiencing a Global Outage?

A critical vulnerability and a service outage are two different issues.

A PHP-powered website may become unavailable because its administrators temporarily restrict access, because a hosting provider experiences problems, or because an incident affects the underlying infrastructure. However, the existence of a security vulnerability does not establish that PHP as a whole is down.

If your website is not working, check your hosting provider’s status page, web server logs, PHP error logs, and recent deployment changes. These checks can help distinguish a security-related interruption from a separate technical problem.

Conclusion

The PHP security disclosures of October 2026 highlight the importance of maintaining secure and supported server environments. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 present serious risks because they may permit unauthenticated remote code execution under affected configurations.

Developers and administrators should verify every relevant PHP runtime, install the corrected releases, review suspicious activity, and investigate potential compromise where appropriate.

PHP remains an important technology for modern web development, but keeping websites secure requires prompt patching, careful configuration, and continuous monitoring.

The key takeaway: Check your PHP version today, apply the official security update, and investigate any signs that your server may already have been compromised.