Developers of the PHP programming language have released security updates to fix two critical vulnerabilities, urging users to update immediately as website operators work to protect their systems.
Government websites in Europe and elsewhere went offline on Wednesday following the disclosure of the vulnerabilities which reported that website operators were scrambling to secure their systems, Reuters reported.
PHP underpins large parts of the internet, raising concerns that websites and other services relying on the widely used programming language could be vulnerable to attack.
What are the PHP vulnerabilities?
The security updates address two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could cause memory corruption under certain conditions and potentially allow attackers to execute code without authentication, according to the UK National Cyber Security Centre (NCSC).
The first vulnerability involves an out-of-memory condition that can interrupt PHP while internal request data is only partially initialised. During cleanup, the system may incorrectly treat invalid data as valid.
The second involves internal request data remaining in use after the memory backing it has been freed. A subsequent request handled by the same worker could then access that stale data before normal initialisation resets it.
Both vulnerabilities were rated 9.2 under version 4 of the Common Vulnerability Scoring System (CVSS v4), according to the PHP Foundation.
Which PHP systems are at risk?
All PHP installations serving web requests could be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The PHP security team identified mod_php as the configuration facing the highest risk, citing a demonstrated exploit in which an unauthenticated request could trigger the attack before application code runs.
PHP is a server-side scripting language used to build websites and web applications. It generates dynamic content, interacts with databases and handles backend processes before delivering content to users' browsers.
PHP releases security updates
In a post on Tuesday, October 20, the PHP Foundation announced that security updates addressing the two vulnerabilities would be released at 14:00 UTC on Wednesday, October 21, 2026.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
— The PHP Foundation (@ThePHPF) October 20, 2026
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
The team urged users to prepare to update, warning that the release could be brought forward if technical details became public or evidence of active exploitation emerged.
The security fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP Foundation.
Users running Linux distributions or long-term support (LTS) versions should check with their vendors for updated packages, as patches were provided in advance.
PHP 8.1 and older versions no longer receive updates directly from the PHP project. However, some distributions and LTS vendors may provide backported fixes. Users should contact their vendors for details or upgrade to a supported version.
The PHP security team also provided limited source-code backports for PHP 7.4, 8.0 and 8.1 to help users building from source or those without access to an LTS vendor.
NSA warns organisations to prepare for updates
The US National Security Agency (NSA) issued a warning on X, advising organisations using PHP to prepare for the security update.
The agency said the vulnerabilities could provide a path to a server's file system or database. It recommended that organisations unable to apply an update immediately consider taking affected systems offline until they could be fully mitigated.
The PHP security team cautioned that additional measures could reduce exposure to specific attack paths but would not make an installation safe. Applying the security update remains the complete solution.