By Aidan Furlan, CTO
If your website or web application runs on PHP, update it now. On 21 October 2026 the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which can let an attacker run their own code on your server without logging in.
PHP powers a large share of the web, including WordPress, Drupal, Joomla, Magento and many custom-built sites. Attacks were already seen before the fixes came out, so this is not one to leave until next month's maintenance window.
Are our own systems affected?
No. We don't use PHP, so this doesn't affect us. This post is a heads-up for our clients.
What happened
On 20 October, details of both flaws leaked online ahead of their planned disclosure, and the PHP project warned administrators that emergency patches were coming. The next day, 21 October, it released fixed versions and published full details. Because of the leak, attackers had a head start: researchers and Cloudflare reported attack traffic before the patches were out.
In technical terms, both are memory-handling bugs inside PHP itself. That means a site can be vulnerable even if its own code is well written.
Who is affected
Any server that uses PHP to handle web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php setups as the highest risk, because the attack works before your site's own code even runs.
You may be running PHP without realising it. Common places it hides:
Content management systems such as WordPress, Drupal and Joomla
Online shops, booking systems and customer portals
Hosting control panels and webmail
Network appliances, monitoring dashboards and admin tools
Docker containers and images built on top of PHP
Singapore's Cyber Security Agency specifically advises checking for PHP inside third-party applications, even if your main website doesn't use it.
What to do now
Upgrade to a fixed version as soon as possible, starting with anything reachable from the internet. The fixed versions are:
PHP 8.5: 8.5.12 or later
PHP 8.4: 8.4.27 or later
PHP 8.3: 8.3.36 or later
PHP 8.2: 8.2.35 or later
PHP 8.1 or older: no official fix, so plan an upgrade
Find every PHP installation. Check websites, servers, containers and any appliances or tools that might bundle PHP.
Patch. If you're on shared or managed hosting, ask your provider to confirm they have applied the fix. If you manage your own server, update PHP directly.
Check the patch really landed. Linux distributions such as Ubuntu and Debian often backport fixes without changing the version number, so a normal system update may or may not include it. Check your distribution's security notice for these two CVEs.
Deal with old versions. PHP 8.1 and older no longer receive security updates from the PHP project. These sites need an upgrade or migration plan, not just a patch.
Look for signs of compromise. Because attacks started before the fix, check for unexpected processes, new files or user accounts, and unusual outbound connections from your web server.
For full technical details and temporary mitigations, see the PHP project's announcement and the Canadian Centre for Cyber Security alert.
Need a hand?
If you're not sure where to start, we can help with an audit and remediation. This is especially worth a conversation if:
No one is actively managing your website. Sites built years ago by a developer or agency who has since moved on often go unpatched.
You're stuck on an older version of PHP. We can help you plan a safe upgrade or migration, so you're not left without security fixes.
You're not sure whether you use PHP at all. We can check your websites, servers and tools and tell you exactly where it is and what needs doing.
Talk to us and we'll help you work out what's affected and get it fixed.