Emergency security updates for PHP were released on October 21, 2026, after two critical vulnerabilities triggered cybersecurity warnings and precautionary website shutdowns across Europe. Government agencies, hosting providers and other organizations temporarily restricted access to online services while preparing to secure vulnerable systems.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on affected servers without authentication. Both received severity scores of 9.2 under the CVSS v4.0 system.
The PHP development team has now released fixes for four supported versions. However, the availability of patches does not mean every affected website has installed them. European cybersecurity authorities continue to urge organizations to prioritize internet-facing systems and apply the updates immediately.
What Are the Critical PHP Vulnerabilities?
PHP is a server-side programming language used by websites and web applications to process requests, generate pages and interact with databases. It also underpins popular content management systems, including WordPress.
That widespread use makes vulnerabilities in the PHP runtime particularly significant. A weakness in the underlying software can potentially affect multiple applications even when their own code has not changed.
According to the official PHP security advisory, the two vulnerabilities involve different problems in PHP's internal handling of memory and request data.
- CVE-2026-109618: A flaw involving out-of-memory handling can leave internal request data partially initialized, creating conditions that may lead to remote code execution.
- CVE-2026-109619: A separate vulnerability involves internal state surviving after its underlying memory has been freed, potentially allowing subsequent requests to interact with invalid data.
Both vulnerabilities can be exploited without prior authentication under affected conditions. The PHP security team identifies several potentially vulnerable server configurations, including PHP-FPM, Apache mod_php and other environments. It considers the risk especially serious for mod_php, where an unauthenticated exploit has been demonstrated.
Remote code execution can potentially give an attacker control over operations performed by the vulnerable server process. The resulting damage would depend on the server's configuration, permissions and other security protections.
Importantly, the existence of these vulnerabilities does not establish that every website running PHP has been successfully attacked.
Why Websites and Online Services Were Taken Offline
Cybersecurity authorities warned organizations to prepare for immediate updates and consider temporarily isolating exposed applications when prompt patching was impossible.
The initial warnings were described in Reuters' October 21 reporting, as public-sector organizations and other website operators faced the possibility of serious security exposure.
In the Netherlands, the government confirmed that several public services were temporarily taken offline as a precaution. These included Overheid.nl, MijnOverheid.nl and DigiD, which provide access to government information and digital services.
The Dutch government's announcement emphasized that the shutdowns were preventive. Its statement at the time did not identify evidence of active exploitation affecting those services. It also clarified that many other government websites did not use PHP and therefore were not exposed to these particular vulnerabilities.
Other organizations across Europe also restricted services while assessing the risks. The measures reflected an effort to reduce opportunities for exploitation rather than proof that the affected websites had already been compromised.
A temporary shutdown can prevent legitimate visitors from accessing a service, but it may also reduce a vulnerable application's exposure until administrators complete security updates.
Which PHP Versions Have Security Fixes?
On October 21, the PHP development team released four security updates addressing both vulnerabilities. The fixed versions are:
| PHP version branch | Security release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
The developers strongly recommend updating affected installations immediately. Their announcement makes clear that temporary mitigations cannot provide the same comprehensive protection as a security fix.
Administrators should also check their operating system or hosting provider's security notices. Some Linux distributions and long-term-support vendors provide backported fixes, meaning a package may contain the relevant corrections without displaying one of the standard upstream version numbers.
PHP 8.1 and older versions no longer receive normal upstream security maintenance. The PHP team has nevertheless provided limited source-level backports for versions 7.4, 8.0 and 8.1, while some vendors maintain their own supported packages.
For organizations relying on these older branches, verifying the exact vendor-supported fix is essential. Installing a newer version of a website application or plugin does not necessarily update the PHP runtime underneath it.
Have Hackers Exploited the PHP Security Flaws?
Evidence of malicious activity has emerged, but the distinction between attempted exploitation and confirmed compromise remains important.
In its October 21 security analysis, Cloudflare reported observing attack traffic targeting customers and attempts to modify malicious requests to evade protective rules.
The company said it deployed web application firewall protections ahead of the public disclosure and continued monitoring for additional attack techniques.
Those observations establish that attackers were attempting to exploit the vulnerabilities. They do not, by themselves, establish how many attacks succeeded, which organizations may have been compromised or whether attackers obtained sensitive information.
No comprehensive, independently verified global count of successful compromises was established in the official advisories and security reporting reviewed on October 22.
Cloudflare's protections may help block known attack patterns, but the company also advises customers to update their PHP installations. Firewall rules cannot guarantee protection against every possible exploitation technique.
What Website Operators Should Know Now
The European Union Agency for Cybersecurity (ENISA), alongside other European institutions, recommends that organizations identify PHP-based applications, coordinate with hosting and service providers, and apply the released updates.
Internet-facing services deserve particular attention because they may receive requests directly from potential attackers.
For organizations responsible for their own infrastructure, the immediate priority is to establish which PHP versions are actually running, determine whether their installed packages contain the fixes, and ensure that updated services are operating correctly.
Where prompt updates are unavailable, the earlier CERT-EU advisory recommends considering temporary isolation of exposed applications from public networks.
Managed-hosting customers may depend on their providers to update server software, while operators of self-managed servers generally remain responsible for maintaining their own installations. Customers should verify how responsibilities are divided rather than assume an update has already been applied.
Ordinary website visitors generally cannot patch the PHP runtime running on a service they use. They may encounter temporary maintenance notices while operators complete updates, but those notices alone do not indicate a data breach or a threat to their personal devices.
What Happens Next?
The October 21 security releases represent a major step toward resolving the PHP emergency, but the remaining risk depends on how quickly vulnerable systems are updated.
Some hosting providers have reported restoring services after completing their fixes. For example, EDIS Global confirmed on October 21 that its affected management services were operational again following security updates.
Individual restoration announcements, however, do not establish that all affected services worldwide have recovered.
The most important developments to monitor are additional confirmed compromises, newly identified exploitation methods, vendor-specific updates and the restoration of temporarily unavailable public services.
For now, the essential distinction is clear: PHP developers have released fixes for the two critical vulnerabilities, but protection depends on those corrections being successfully deployed to affected systems. Until then, organizations running vulnerable installations may continue to face serious security exposure.
0 Comments