PHP Just Patched Two Critical Remote Code Execution Flaws. Update Now.

PHP Issues Urgent Security Updates: Developers and system administrators are advised to update their PHP installations right away. The latest patch resolves two high-severity Remote Code Execution flaws that could allow attackers to compromise vulnerable servers.

October 21, 2026

If your website runs on PHP, check your version today. The PHP security team released emergency fixes this morning for two critical vulnerabilities, and attack tools are already circulating online.

The fix: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Any earlier release of those branches is exposed.

What happened

Details of two flaws, CVE-2026-109618 and CVE-2026-109619, leaked on October 20 before the planned disclosure date. The PHP team moved its patch release up in response. Both flaws carry a CVSS v4.0 score of 9.2 and can let an attacker run code on your server without logging in. Researchers have nicknamed them “PHP2Shell.”

Both are memory-safety bugs in how PHP handles errors while processing a web request. One involves running out of memory partway through setting up a request. The other involves leftover data from one request that a later request can reuse.

Why this one matters

PHP sits underneath WordPress, Joomla, Magento, and a huge number of custom sites. The flaw is in PHP itself, so you can’t fix it by updating a plugin or theme. The server has to be updated. Palo Alto Networks counted more than 22.6 million internet-exposed instances that could be vulnerable, and Cloudflare reports that exploitation attempts have begun.

If you run an older version

PHP 8.1 and earlier no longer get official releases. Security researchers say the flaws may reach back as far as PHP 5, though PHP’s own advisory hasn’t confirmed that range. If you’re on an unsupported version, ask your host whether they are backporting the fix, and plan an upgrade. Even supported versions are on a clock: PHP 8.2 reaches end of life on December 31, 2026.

What to do today

Find out which PHP version your site really runs. Command-line checks can differ from what your web server uses, so check your hosting panel.
Update to a patched release, or ask your host when they’ll roll it out.
If you can’t patch yet, take the site offline or follow the temporary mitigations in PHP’s official advisory. Expect some features, like file uploads, to break.
Check your logs for unusual script activity, new files you didn’t create, or strange outbound traffic. Patching stops new attacks but doesn’t remove someone who already got in.

Details are changing quickly. Check the PHP advisory at php.net before acting.

Source:

https://therecord.media/php-script-vulnerabilities-warnings