Php Releases Emergency Patches For Two Critical Vulnerabilities
PHP has released fixes for two critical flaws affecting web-facing installations, while security researchers warn that unpatched servers could be exposed to rapid attacks.
PHP developers released emergency updates Wednesday for two critical vulnerabilities in the widely used web programming language, according to Wired. The PHP Foundation identified the flaws as CVE-2026-109618 and CVE-2026-109619 and urged users to update. Both carry a severity score of 9.2 out of 10.
Table of Contents
What is affected
The PHP Foundation said the vulnerabilities affect PHP installations serving web requests as far back as PHP 5, which was released in 2004, Wired reported. Only PHP 8.2 and newer are still supported and will receive official patches, although some distributors and third-party vendors continue to provide fixes for older versions.
PHP underpins web software including WordPress and Drupal. Engadget reported that a demonstration called PHP2Shell showed code running on servers hosting several PHP-based applications. It also cited security firm watchTowr, which said it had confirmed the vulnerability, while describing a report that an attacker could take control of a server as unverified.
Attack concerns and patching
According to Wired, researchers at security company Wiz said the vulnerabilities could allow an unauthenticated attacker to run code on an affected server or read process memory. Such memory could contain passwords, authentication tokens, API keys or certificates. Wiz said it discovered the issues partly with AI tools; OpenAI and security firm Calif also said they independently found them and worked together.
The prospect of attacks beginning before sites are updated has put administrators under pressure. Wired reported that Cloudflare saw early attacks emerging before the PHP Foundation published details and fixes. Security firm Sansec predicted mass attacks could begin within 15 minutes of the release. Those are warnings and observations from the named organizations, not a confirmed account of widespread exploitation.
The PHP Foundation said updating is the only safe choice and that there are no complete mitigations, according to Wired. Its October 20 advance notice gave teams time to prepare. Wired said some organizations took websites offline as a precaution before the updates became available.
What teams should do
For teams responsible for web services, the immediate task is to find PHP installations and update supported versions. Wired reported that the UK’s National Cyber Security Center advised organizations to identify PHP systems, prioritize those connected to the internet and monitor them for possible exploitation. Where an immediate fix is not feasible, the agency said organizations should consider taking the affected system offline until it can be fully addressed.
Older installations present a particular challenge: the flaws reach back to PHP 5, but official patches cover only currently supported versions. Teams maintaining legacy services may need to check whether their PHP distributor or another vendor provides a fix.
Sources
This story was compiled by AI from the reports below. Read the originals for the full details.