PHP rushes out fixes for two critical remote-code flaws: what website owners need to do now

The PHP project released emergency updates on Wednesday, October 21, 2026 — versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — to close two critical vulnerabilities that can let attackers run their own code on web servers. The PHP Foundation’s message to anyone running PHP was blunt: update now.

What the flaws are

The two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, sit in the way PHP manages memory and recovers from errors, code paths that nearly every web request touches. The first can be triggered when a request hits PHP’s memory limit at an unlucky moment, so that partially built internal data is treated as valid and memory gets corrupted. The second involves a fatal error leaving internal state pointing at memory from a previous request, a so-called use-after-free.

According to the PHP Foundation, the first flaw can be triggered on Apache with mod_php by an unauthenticated request before any application code runs, and remote code execution was demonstrated with default settings. It was also confirmed on PHP-FPM through application-level code paths. The second was demonstrated against a real-world application on Apache with mod_php. The Foundation rates the severity at CVSS 9.2, correcting a leaked report that listed 10.0.

Why it matters

PHP powers a large share of the web, including WordPress, the system behind this site. Security firm Snyk says every PHP installation serving web requests should be treated as at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the most exposed. Democracy Now! reported that parts of Wikipedia and the BBC went offline on Wednesday while being patched; SagaTVec.lat has not independently confirmed those outages.

Who found them, and the role of AI

The Foundation says researcher Ryan A of the security firm Calif reported the core problem on August 11, 2026, and that OpenAI independently reported the same root cause that day, followed by more attack paths on September 18. Wiz reported additional vectors on August 24. AI tools helped validate and group reports, the Foundation says, but people made every decision and wrote every patch.

The Foundation also admitted that the roughly ten-week gap before the fix was “a structural failure” of its decision process and resources. It announced changes: security decisions by majority vote, earlier involvement of leadership in serious cases, and more staff dedicated to triage and hardening.

What to do

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions may ship the fix under an older version number, so check your distribution’s advisory.
• On shared or managed hosting, ask your provider whether the patch has been applied.
• PHP 8.1 and older no longer get official releases. The project published source backports for 7.4, 8.0 and 8.1, but upgrading is the safer route. PHP 8.2 itself reaches end of life on December 31, 2026.
• Snyk lists partial configuration mitigations but stresses that there is no complete workaround: updating is the only safe choice.

Confirmed and pending

Confirmed: the fixed versions, CVE identifiers and severity score published by the PHP Foundation. Not established in the sources we reviewed: whether attackers are already exploiting the flaws in the wild. The US cybersecurity agency CISA issued an alert on October 21 urging immediate patching; its page could not be loaded during our review.

Featured image: illustrative photo of source code by Ilya Pavlov / Unsplash (Unsplash License).

Sources

• The PHP Foundation: Today’s PHP Security Release (October 21, 2026)
• Snyk: PHP fixes two critical unauthenticated RCE flaws (October 22, 2026)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026)
• Democracy Now! Headlines (October 22, 2026)

Evely Vélez · Technology · Virtual editorial byline
Editorial direction: Leonidas Ferraz · October 22, 2026 · AI-assisted writing