PHP Issues Urgent Security Fixes: What Website Owners Should Check
New patches address two vulnerabilities that could let attackers run code without logging in. Start by confirming what your host runs and whether both fixes are deployed.
The actual story.
If you run a website, the useful question today is whether the server behind it has received PHP’s latest security fixes.
On October 21, the PHP project released updates for two critical vulnerabilities that can allow remote code execution without a login. Its warning covers PHP installations serving web requests, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed. That is a reason to check your hosting setup, not assume every website uses vulnerable PHP. PHP security announcement
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. One involves memory corruption during out-of-memory handling; the other involves internal state surviving after its underlying memory has been freed. Both advisories classify the issues as critical. First PHP advisory, second PHP advisory
PHP identifies mod_php as the highest-risk setup, citing a demonstrated attack that can run before application code starts. The team says configuration workarounds reduce only particular attack paths. Updating is the complete remedy. PHP security announcement
What website owners should do
1. Confirm the runtime. Ask your host or developer whether the live site uses PHP, which branch it runs and who manages updates. Check the production environment, not just a developer’s laptop.
2. Ask about both fixes. Request confirmation that the running service includes the patches for both CVEs, plus the package version or vendor advisory supporting that answer. Keep the response with your maintenance records.
3. Update through the supported process. Have the responsible administrator use the host’s or operating-system vendor’s update instructions. Before changing production, confirm the backup and rollback plan; afterward, verify the patched service is running and test essential functions such as login, forms and checkout. Do not improvise server configuration changes from a social post.
The upstream patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s patched-version list
Some vendors provide backported fixes, so ask for their security status rather than judging solely by an older-looking version number. For PHP 8.1 or earlier, PHP advises contacting the vendor or moving to a supported release. PHP update guidance
PHP 8.2 users also have a planning deadline: upstream security support ends December 31, 2026. Patch now and plan the next upgrade separately. PHP support schedule
For site owners, the immediate goal is a verified patch status and a responsible person handling it. A vulnerability announcement alone does not establish that your website has been compromised.
Confirm the live PHP runtime and verified patch status for both CVEs with the responsible administrator; recheck official guidance before publication.
Receipts, not rumors.
PHP security announcement and release notices, October 21, 2026
https://www.php.net/archive/2026.php
PHP source security advisory for CVE-2026-109618
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
PHP source security advisory for CVE-2026-109619
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
PHP supported versions schedule
https://www.php.net/supported-versions.php
Read the original reporting: PHP project; php/php-src security advisories ↗
The reporting above provides context. Illustrations are editorial interpretations, not source photographs. The copy and illustration were created with AI session tools from the linked source.
Got a better punchline?