Critical PHP Flaws Prompt Emergency Updates: Is Your Website Vulnerable?

WEST PALM BEACH, FL – The PHP development team released emergency security updates on October 21, 2026, addressing two critical vulnerabilities that could allow attackers to execute malicious code on affected web servers without logging in. Website owners should contact their hosting providers or server administrators immediately to confirm that the fixes have been installed.

The vulnerabilities, widely referred to as PHP2Shell, affect the underlying software used to run many websites and applications. That makes this a hosting and server maintenance issue, even for businesses that already keep their website content, plugins and themes updated.

Cloudflare’s advisory makes the distinction clear: updating website code or plugins alone does not resolve these vulnerabilities. The PHP software running the application must be patched.

What Makes These Vulnerabilities So Serious?

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a critical severity rating of 9.2 under the Common Vulnerability Scoring System.

The first involves how PHP handles memory exhaustion. Under certain conditions, processing can stop before internal data is properly initialized, and PHP may then handle that unfinished data unsafely during cleanup. The PHP project confirmed remote code execution against Apache configurations using mod_php, with the attack occurring before the website’s own application code begins running. Successful execution occurs with the permissions of the web worker account.

The second involves internal information left behind after a request ends. A PHP worker can retain references to memory that has already been released, then access those references while handling a later request. Exploitability depends on the application, configuration and internal operations involved, but PHP’s advisory says a carefully constructed attack can achieve remote code execution.

For businesses, the potential consequences include exposed information, unauthorized changes and disrupted services. Cloudflare reported observing attack traffic targeting these vulnerabilities, making prompt action more than a precaution against a theoretical threat.

Which Websites Are Affected?

PHP’s warning covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration.

Websites and applications built with WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel may require action because they rely on PHP. A hosting provider may manage the necessary update, while owners of self-managed virtual private servers generally need to arrange it themselves. GoDaddy’s published guidance distinguishes these responsibilities by hosting product.

An affected installation does not automatically mean a website has been compromised. It means its PHP software requires remediation, with the practical attack risk depending on its environment.

AI Helped Researchers Uncover the Vulnerabilities

The vulnerabilities were uncovered through AI-assisted security research involving Calif, OpenAI and Wiz. According to the PHP Foundation, early signs of one underlying memory-management problem were identified in 2024, but its practical exploitability had not been established and work on a fix stalled. In August 2026, researchers demonstrated working attacks, making the full danger clear. AI tools helped researchers analyze complex code and develop test exploits, while human researchers and PHP maintainers investigated the findings and produced the fixes.

Which PHP Versions Contain the Fixes?

The October 21 security releases provide the following patched versions:

These versions are identified in the PHP project’s official security announcement. Website owners should install the fixed release for their supported branch, or a later release containing the fixes.

Some operating system and extended-support vendors apply security fixes to their existing packages, a process called backporting. Consequently, a version number alone may not establish whether a vendor-maintained package is protected. Administrators should check the vendor’s security notice and package revision.

PHP 8.1 and older no longer receive normal upstream updates. Some vendors provide backported fixes, and PHP published exceptional source backports for versions 7.4, 8.0 and 8.1. These emergency measures should accompany a plan to move to a supported branch.

What Website Owners Should Do Now

Start by asking your hosting provider or administrator to confirm that both CVE-2026-109618 and CVE-2026-109619 have been addressed for your website. Request confirmation of the installed PHP package and whether the necessary services have been restarted.

For administrators, the update process should include a backup or snapshot, installation of the patched packages, restarting the relevant PHP and web server services, and verification that the website actually uses the updated runtime. Servers supporting multiple PHP versions need each relevant installation checked. WordPress users can find their website’s reported PHP version under Tools → Site Health → Info → Server.

Afterward, test the functions that matter to the business: contact forms, checkout, account access, uploads and any custom integrations. A successful homepage load is only one part of confirming that the site works correctly.

Can a Firewall Provide Protection?

Cloudflare says it deployed protections for customers using its free and paid web application firewall services. However, the company still urges administrators to patch PHP and retain the firewall as an additional layer of protection.

PHP also published temporary configuration mitigations, but warns that they cover only particular attack paths. They do not make an unpatched installation safe. Where immediate patching is impossible, CERT-EU recommends considering isolation of internet-facing applications until the fix has been applied and verified.

For business owners, the immediate priority is to establish who maintains the server software and obtain confirmation that this update is complete. Website maintenance extends beyond the administration dashboard. The infrastructure processing every visitor’s request needs the same attention as the pages, plugins and applications built on top of it.

John Colascione

John Colascione is Chief Executive Officer of SEARCHEN NETWORKS®, a digital marketing and technology company founded in 2001. An entrepreneur, author, and digital publisher with more than 25 years of experience, he specializes in search engine marketing, Website Monetization, domain names, and online business development. He is the author of Mastering Your Website and publishes commentary on technology, digital marketing, and the evolving Internet economy. Read more at JohnColascione.com.