Critical PHP Security Alert: Emergency Update Required for CVE-2026-109618 and CVE-2026-109619!

Critical PHP Security Vulnerability: Updates Released for CVE-2026-109618 and CVE-2026-109619

The PHP development team has released security updates to address two critical vulnerabilities that may affect PHP-based web servers. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities could, under certain conditions, allow unauthenticated remote code execution.

Organizations and website owners using PHP are advised to update their systems to the latest secure versions.

On October 21, 2026, the PHP team released new versions to address these two critical security vulnerabilities.

The issues were registered as CVE-2026-109618 and CVE-2026-109619. According to PHP’s official security advisory, the vulnerabilities may allow remote code execution without authentication on affected systems under specific conditions.

In its preliminary advisory, PHP rated both vulnerabilities as Critical, with a CVSS v4.0 score of 9.2.

Which PHP Versions Are Affected?

The PHP development team released four updated versions containing security fixes.

The recommended PHP versions are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

System administrators running PHP 8.5, 8.4, 8.3, or 8.2 are advised to upgrade to the corresponding security release.

PHP’s official advisory also notes that temporary mitigations may not provide complete protection, making an update to a patched version the recommended solution.

What Are CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 and CVE-2026-109619 are two vulnerabilities affecting the PHP runtime environment that may lead to remote code execution under certain conditions.

Remote Code Execution, commonly known as RCE, is considered a serious class of security vulnerability. If successfully exploited, an RCE vulnerability may allow an attacker to execute unintended code on a vulnerable system within the privileges available to the affected process.

However, this does not mean that every website using PHP can automatically be compromised.

Whether a system is actually vulnerable depends on several factors, including:

The PHP version in use

Server configuration

How PHP is integrated with the web server

Whether the latest security updates have been installed

Which PHP Environments May Be at Risk?

According to PHP’s official security information, PHP installations that process web requests should be reviewed and updated where necessary.

Affected or relevant environments may include:

• PHP-FPM
• Apache mod_php
• php-cgi
• FrankenPHP
• LiteSpeed

The PHP team has indicated that the risk may be higher in environments using Apache with mod_php.

The official advisory states that a scenario was demonstrated in which the issue could be triggered before application-level PHP code begins execution when mod_php is used.

Are WordPress and Other PHP-Based Websites Affected?

There is an important distinction when discussing WordPress, Laravel, and other PHP-based applications.

These vulnerabilities were not announced as vulnerabilities in WordPress or Laravel themselves. They affect the underlying PHP runtime environment.

For this reason, simply knowing that a website uses WordPress or Laravel is not enough to determine whether the system is vulnerable.

The PHP version and server configuration must also be checked.

For example, a web application running on an outdated PHP version should be reviewed by the system administrator or hosting provider, and the necessary security updates should be applied.

ENISA Urges Organizations to Apply Security Updates

The issue has also been addressed by the European Union Agency for Cybersecurity, ENISA.

ENISA, together with the European Commission, CERT-EU, Europol EC3, and the European CSIRTs Network, called on organizations to take appropriate action against the two critical PHP vulnerabilities.

The guidance particularly recommends prioritizing internet-facing PHP systems, identifying PHP-based applications, and coordinating with hosting or service providers to apply the necessary security updates.

What Should PHP Website Owners Do?

Website owners and system administrators running PHP-based websites or servers should first verify which PHP version is currently in use.

Recommended security steps include:

• Check the PHP version running on the server.
• Confirm that the latest security release is installed.
• Review security notices from your hosting provider.
• Prioritize internet-facing systems for patching.
• Test web applications after the update.

Plan migration away from outdated and unsupported PHP versions.

Website owners using shared hosting may not be able to update PHP directly. In such cases, they should contact their hosting provider to confirm which PHP security version is currently deployed.

PHP 8.2 Support Is Approaching Its End

According to PHP’s official support lifecycle, security support for PHP 8.2 is scheduled to end on December 31, 2026.

Therefore, although upgrading to PHP 8.2.35 is important for addressing the current vulnerabilities, organizations still using PHP 8.2 should also begin planning a migration to a newer, supported PHP branch.

Why Is the PHP Security Update Important?

PHP is one of the most widely used programming languages for web applications worldwide.

For this reason, critical vulnerabilities affecting the PHP runtime are relevant not only to software developers but also to system administrators, hosting providers, and website owners.

The key point is to verify whether systems are up to date rather than assuming that every PHP-based website is automatically at risk.

Since security patches have already been released by the PHP development team, administrators can reduce exposure by installing the appropriate updated version.

Check Your PHP Version

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities identified by the PHP development team.

The security issues are addressed in:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Website owners, developers, and system administrators using PHP are advised to verify their current PHP version and apply the necessary security updates.

Using PHP alone does not mean that a website has been compromised or is definitely vulnerable. The actual level of risk depends on the PHP version, server configuration, and whether current security patches have been applied.

Frequently Asked Questions

Has a New PHP Security Vulnerability Been Discovered?

Yes. The PHP team released security updates on October 21, 2026, for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.

How Severe Are the PHP Vulnerabilities?

According to PHP’s advisory, both vulnerabilities received a CVSS v4.0 score of 9.2, placing them in the critical severity category.

Which PHP Version Should I Upgrade To?

Depending on the PHP branch currently in use, administrators should upgrade to:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Are WordPress Websites Affected?

The vulnerabilities are not specific to WordPress. They affect the underlying PHP runtime.

To determine whether a WordPress website may be affected, the server’s PHP version and configuration should be checked.

Is Every Website Using PHP at Risk?

No. Simply using PHP does not automatically mean that a website is vulnerable.

The level of risk depends on the PHP version, server configuration, deployment method, and whether the latest security updates have been installed.