A critical security alert has been issued for PHP following the discovery of two vulnerabilities that can allow attackers to execute arbitrary code remotely on vulnerable servers.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026. Both vulnerabilities are rated Critical, with a CVSS v4.0 score of 9.2.
For businesses running PHP-powered websites, WordPress installations, Laravel applications, custom PHP systems, or PHP-based hosting environments, this is a security issue that should not be ignored.
What Are the PHP Vulnerabilities?
The two vulnerabilities affect the PHP runtime itself and can potentially allow an unauthenticated attacker to achieve remote code execution (RCE).
In simple terms, an attacker may be able to send a specially crafted request to a vulnerable PHP installation and execute malicious code on the server without first logging into the application.
This could potentially lead to:
- Website compromise
- Malware installation
- Unauthorized file access
- Database compromise
- Web shell installation
- Theft of sensitive information
- Further attacks against other systems
Security researchers have warned that internet-facing PHP systems should be patched as quickly as possible.
Which PHP Versions Are Affected?
The vulnerabilities affect PHP installations across a broad range of versions.
The PHP project has released security updates for currently supported branches:
| PHP Branch | Secure Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older versions are no longer receiving official security patches for this issue. Organizations using these versions should plan an upgrade to a supported PHP release.
Who Could Be at Risk?
This is not limited to one particular CMS or hosting provider.
PHP is widely used across the web, including:
- WordPress websites
- Laravel applications
- Custom PHP websites
- E-commerce platforms
- PHP APIs
- PHP-FPM environments
- Apache with mod_php
- PHP-CGI
- LiteSpeed
- FrankenPHP
- Containerized PHP applications
The PHP security advisory specifically identifies multiple PHP server configurations as potentially affected.
Why Is This Vulnerability Serious?
Remote Code Execution vulnerabilities are among the most serious types of server vulnerabilities.
An attacker does not necessarily need a valid administrator account to attempt exploitation. If a vulnerable PHP runtime is exposed to the internet, a successful attack could allow malicious code to execute with the privileges available to the PHP process.
That can turn a seemingly normal website vulnerability into a full server security incident.
For businesses, the consequences can include downtime, data loss, SEO damage, malware infections, customer-data exposure and reputational damage.
What Should Website Owners Do?
1. Check Your PHP Version
The first step is to determine which PHP version your website is running.
Depending on your hosting environment, you may be able to check this through:
- cPanel
- Plesk
- Hosting control panels
- SSH
- WordPress tools
- Server management dashboards
If you manage a VPS or dedicated server, check every PHP installation rather than assuming there is only one.
2. Upgrade to a Patched PHP Version
If your server is running PHP 8.2 or newer, update to the latest patched release available for your branch.
For example:
PHP 8.2 → 8.2.35
PHP 8.3 → 8.3.36
PHP 8.4 → 8.4.27
PHP 8.5 → 8.5.12
The PHP project recommends updating immediately.
3. Don’t Forget WordPress
If you operate WordPress websites, updating WordPress plugins and themes alone is not enough.
PHP is part of the server environment that runs WordPress.
A website can have the latest WordPress version while still running an outdated and vulnerable PHP version.
Website owners should therefore check both:
WordPress security + PHP security + server security.
4. Check Your Other Applications
PHP may also be running outside your main website.
Check:
- Staging websites
- Development servers
- Subdomains
- APIs
- Old applications
- Docker containers
- Backup servers
- Internal tools
- Legacy websites
DigitalOcean’s advisory also recommends checking PHP installations across different infrastructure rather than assuming only the primary application is affected.
What If You’re Running an Older PHP Version?
If your website still depends on PHP 7.x, PHP 8.0 or PHP 8.1, this should be treated as an opportunity to review the entire hosting environment.
Older PHP versions may not receive official security fixes for current vulnerabilities.
Simply keeping an old PHP version because a website “still works” can create a significant security risk.
Before upgrading a production website, test compatibility with:
- WordPress
- Plugins
- Themes
- PHP extensions
- Custom code
- APIs
- Database integrations
A controlled upgrade is generally safer than leaving an internet-facing server on unsupported software.
Don’t Wait for Signs of an Attack
One of the biggest mistakes businesses make is waiting until a website displays malware, redirects visitors or gets suspended by a security service.
By then, the attacker may already have access.
For critical server vulnerabilities, prevention is significantly better than recovery.
Website administrators should patch vulnerable systems, review server logs and monitor for unusual activity after updating.
Akkenum Interactive’s Recommendation
At Akkenum Interactive, we recommend treating critical PHP vulnerabilities as a server-level security issue rather than simply a website update.
If your business operates PHP-based websites or applications, we recommend:
1. Identify all PHP installations
2. Check the currently installed PHP versions
3. Upgrade supported PHP branches immediately
4. Plan migration from unsupported PHP versions
5. Update WordPress, plugins and themes
6. Review server and application logs
7. Check for unexpected files or administrator accounts
8. Maintain regular backups before major upgrades
Security should be part of ongoing website maintenance—not something addressed only after an attack.
Final Thoughts
The newly disclosed PHP vulnerabilities demonstrate why keeping the underlying server environment updated is just as important as maintaining the website itself.
If your website uses PHP, check your PHP version today.
The patched releases are available, and updating to a supported version is the most effective way to protect vulnerable systems.
If you’re unsure which PHP version your website is using or whether an upgrade could affect your website, contact your hosting provider or a qualified web development and security team before making changes.
