PHP’s maintainers released security updates on Oct. 21, 2026, for two critical vulnerabilities that can let unauthenticated attackers execute code remotely. The release creates an urgent infrastructure task for businesses running PHP-based websites, applications and products containing the language.
The PHP project identifies the flaws as CVE-2026-109618 and CVE-2026-109619. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Maintainers urge users to update immediately.
Check the runtime, not only the application
PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php and LiteSpeed. It identifies mod_php as the highest-risk configuration, with a demonstrated attack that can trigger before application code runs.
The Dutch National Cyber Security Centre’s operational guidance says the impact extends beyond websites to appliances, network devices and management interfaces that embed PHP. It advises organizations to inventory runtime versions and check bundled software and vendor updates separately.
Temporary measures are not complete fixes
PHP says its temporary mitigations reduce exposure to particular attack paths but do not make an installation safe. Organizations using older branches should check distribution or long-term-support vendors for backported fixes, rather than assuming a standard version number alone settles their status.
For business leaders, the immediate distinction is between updating an application and verifying the software environment that runs it. These advisories establish a serious vulnerability and available fixes; they do not establish that every exposed organization has suffered a breach.