PHP powers a large part of the web, including popular platforms such as WordPress, Drupal, Joomla, and Magento.
So, when two critical vulnerabilities emerge in the language, the potential impact extends to millions of websites. Both flaws have been rated 9.2 out of 10 in severity, and security experts are warning that attackers could move quickly once the details become public.
The PHP security team says it has scheduled patches for Wednesday, October 21, at 14:00 UTC. But the concern is what happens next. Security firm Sansec expects “mass attacks to start within 15 minutes of the release.”
That leaves website owners little time to react. Here’s what we know about the vulnerabilities and how to prepare your site before the fixes arrive.
Ogbonda Chivumnovu
What we know, and what we don't
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers at watchTowr have confirmed that they are remote code execution (RCE) flaws. These could allow attackers to run their own code on a vulnerable server.
However, PHP has not yet published the technical details or confirmed which versions are affected. Claims that every PHP version dating back to PHP 5 is vulnerable remain unconfirmed by the PHP team.
The official announcement confirms that both vulnerabilities have a CVSS v4.0 score of 9.2. Some early reports cited a score of 10.0, but that is not the rating PHP has announced.
PHP says it will publish the technical details, affected versions, and fixed releases alongside the security update. The team has also reserved the right to release the patches earlier if details become public or evidence of active exploitation emerges.
Only supported PHP branches are expected to receive fixes
This is the part website owners need to pay attention to.
PHP's currently supported branches are 8.2, 8.3, 8.4 and 8.5. PHP 8.1 and older branches are no longer officially supported and are not expected to receive patches through the regular security release.
Mallory estimates that around 884,000 internet-facing hosts are running PHP 8.1 or older. That's approximately 59% of the 1.5 million hosts in its dataset that reported a PHP version.
The expected fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, according to Mallory's report. However, these version numbers have not yet been confirmed in PHP's official announcement, so check the release notes before updating.
How to prepare and patch your server
First, find out who manages PHP on your server. If you're using managed hosting, your provider may handle the update. If you're running a VPS or dedicated server, you or your system administrator may be responsible.
Once the official fix is available, follow these steps:
1. Back up your website
Back up your files and database, and make sure you know how to restore them if something goes wrong.
2. Update PHP to a fixed release
If you use a hosting control panel such as cPanel or Plesk, check whether the patched version is available. If your server runs a Linux distribution, check its package manager for security updates. Some distributions backport fixes without changing the PHP version number to match the upstream release.
3. Restart services if required
Follow your hosting provider's or distribution's instructions to ensure the updated PHP runtime is running. Restart PHP-FPM or other relevant services where necessary.
4. Verify the update
Check the PHP version actually serving your website. Running php -v in a terminal is useful, but it may show a different PHP installation from the one used by your web server. Confirm that the website's runtime has received the fix, too.
5. Deal with unsupported versions
If your server runs an end-of-life PHP branch, contact your hosting provider about upgrading or obtaining a backported fix. If you cannot secure the system promptly, consider taking the affected application offline or isolating it from public access, as CERT-EU recommends.
What to do while you wait
Subscribe for free to continue reading this article
Subscribe SubscribeAlready have an account? Log in
