Critical PHP flaws put web servers at risk: what to patch now

Two critical vulnerabilities in PHP, the language that runs on a large share of websites, can put the servers that use it at risk. The UK’s National Cyber Security Centre (NCSC) issued an alert on Wednesday, October 21, 2026, titled “Critical security issue affecting PHP”, and urged British organisations to act immediately. As the NCSC announced, the vulnerabilities CVE-2026-109618 and CVE-2026-109619 can allow an attacker to execute commands on any web server running PHP.

A fix already exists. The PHP team released the security update on October 21, after an advance notice on the 20th, and in its announcement on php.net describes both vulnerabilities as critical. The advance notice rated them 9.2 on the CVSS v4.0 scale (out of 10). The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the development team, so their users must ask their distribution vendor for a fix or upgrade.

What the flaws are

PHP runs on the web server: it generates the dynamic content of pages, talks to databases and handles an application’s back-end logic. A vulnerability is simply a flaw in software that an attacker can exploit.

In CVE-2026-109618, an attacker can cause PHP to run out of memory. When memory runs out, PHP may stop while some internal request data has not yet been fully initialised, and the cleanup that follows treats it as valid, resulting in memory corruption. In CVE-2026-109619, PHP keeps a request’s data even after its memory has been freed (use-after-free), and the next request in the same process can use it before it is properly initialised again. Under certain conditions the result can be remote code execution without authentication, that is, without a username or password.

All PHP installations that serve web requests are at risk. php.net identifies the greatest danger in the use of PHP as the mod_php module (the Apache module that embeds PHP in the server), where the attack has been shown to succeed with a single request, without authentication and before any application code runs. The NCSC stresses that all versions may be affected and asks that checks not be limited to old ones.

What CISA and the NCSC advise

The US Cybersecurity and Infrastructure Security Agency (CISA) published its own alert the same day and said that at the time of publication it had not observed exploitation of the vulnerabilities. It recommends inventorying all systems that run PHP, even those that contain it inside other software, and updating first those exposed to the internet. Anyone who cannot update immediately, or runs PHP 8.1 or older, should take the system offline.

In the same direction, the NCSC recommends updating exposed systems first. If neither updating nor shutting the system down immediately is possible, it asks for a check for signs of compromise and backdoors. It also asks organisations to keep monitoring vendors’ security updates, since devices and services embed PHP. A list of such products is kept by the Dutch NCSC-NL.

For those who cannot update, php.net suggests temporary measures such as memory_limit=-1, a low post_max_size and disabling session.upload_progress.enabled. It stresses that they do not make an installation safe and that only the update is a complete solution.

Why it matters for WordPress and Greek sites

php.net describes PHP as the language that “powers everything from your personal blog to the most popular websites in the world”, while WordPress.org recommends that hosting providers use PHP 8.3 or newer for WordPress. Every WordPress site, on its own server or with a hosting provider, therefore relies on PHP, and its administrators should check the version and whether the fix has been applied.

The warning comes a day after Symantec’s disclosure of the Russian GRU’s APT28 group targeting NATO entities. The cyber-war threat includes military networks, as the APT28 case shows, but also ordinary PHP-based websites.