Quick answer: On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer) as soon as you can. Internet-facing websites should go first.
If your website, online store or web application runs on PHP, this one needs your attention now.
What happened?
On October 20, the PHP security team announced an urgent release to fix two critical vulnerabilities. Details of the flaws leaked before the official release. Researchers and government security agencies urged administrators to prepare immediately. PHP published the fixes on October 21.
Both flaws can lead to remote code execution (RCE). In plain terms, an attacker could run their own code on your server. The weakness sits in PHP itself, so your site can be exposed even if your own code is clean.
The two vulnerabilities
- CVE-2026-109618: Remote code execution caused by improper handling of out-of-memory conditions inside PHP’s request handling.
- CVE-2026-109619: Remote code execution caused by stale internal state and use-after-free conditions.
Which PHP versions are affected and fixed?
| PHP branch | Fixed in |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
Earlier releases on each branch are affected. Some security agencies warn that very old versions (PHP 5 and later) may also be exposed. These older versions no longer receive official fixes, so the only safe route is upgrading to a supported branch. Note that PHP 8.2 security support ends on December 31, 2026, so plan your move to 8.3 or newer.
Is it being exploited?
Reports of attack attempts began before the patches shipped. A Cloudflare executive said the company was seeing early attacks and deployed temporary firewall rules. Code claiming to exploit the flaws is also circulating publicly, but security vendors have not verified it. Treat any “proof of concept” you find online as untrusted, because fake exploits carrying malware commonly appear after a major CVE.
How to patch
- Managed or shared hosting: Contact your host or switch the PHP version in your control panel. Many hosts are rolling out patched builds.
- VPS or dedicated servers: Update PHP through your package manager and restart PHP-FPM and your web server.
- Docker and CI: Rebuild images from patched PHP base images.
- Laravel Forge and Cloud: The Laravel team said it is working with the PHP Foundation to get patched versions into its base images.
- Test first: Run your staging site on the new version, especially if you jump branches.
PHP’s advisory says updating is the only safe choice. No configuration change fully fixes both issues. Treat any temporary mitigation as a short-term stopgap.
What this means for your platform
- WordPress and WooCommerce: Update PHP at the server level. WordPress core or plugin updates cannot fix a flaw in PHP itself. Confirm your plugins and theme are compatible with your target PHP version before switching.
- Magento: Each Magento release supports specific PHP versions, so check compatibility before upgrading. Test checkout, payment and extension behaviour on staging.
- Laravel and custom PHP apps: Update the runtime in every environment. Review your Composer dependencies for PHP version constraints.
Frequently asked questions
- Do I need to update if I use WordPress?
Yes. WordPress runs on PHP, so the server’s PHP version must be patched. - Is PHP 8.1 or older safe?
Those branches no longer receive official security fixes. Upgrade to a supported version. - Will updating PHP break my website?
It can, mostly through outdated plugins, themes or extensions. Test on staging first. - Can a firewall protect me instead?
A WAF can reduce risk temporarily, but it is not a substitute for patching.
Need help patching your PHP site?
Skylooper is a web development agency with 8+ years of hands-on PHP experience across WordPress, WooCommerce, Magento and Laravel. We can audit your PHP versions, test compatibility on staging and apply the update with minimal downtime. Contact Skylooper today for a fast PHP security check.
