CYBER — The PHP project shipped emergency updates on October 21, 2026, that fix two critical security flaws. These flaws can let an attacker run code on a web server that uses PHP, without needing a login or any credentials.
The updates cover the currently supported versions of PHP. The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day urging organizations to apply the patches immediately and stated it had not observed any exploitation as of the time of publication.
The two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 on the standard severity scale for software vulnerabilities. They affect every PHP installation that serves web requests, including the common setups used with Apache, PHP-FPM, and other web servers.
The risk is highest for Apache servers running the mod_php module, where researchers showed that a simple unauthenticated web request can trigger the problem before any website code even starts running. No threat group has claimed responsibility, and CISA has not linked the flaws to any specific attacker.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older unsupported branches (PHP 8.1 and earlier) do not receive official updates from the PHP project, though limited source-level fixes were provided for some of them.
Linux distributions and long-term support vendors received the patches ahead of the public release so they could prepare their own packages.
PHP is a programming language created in 1994 that runs on web servers to build and deliver websites and web applications. When a visitor requests a page, the server executes the PHP code, generates the finished output (typically HTML), and sends that result to the browser. The PHP source code remains on the server and is never transmitted to the user.
PHP is one of the most widely deployed server-side languages on the public internet. W3Techs data as of October 21 shows that PHP is used by approximately 69.3 percent of all websites whose server-side programming language can be identified.
WordPress, which is built on PHP, accounts for roughly 40 percent of all websites. Other systems that run on PHP include Drupal, Joomla, Magento, and applications built with frameworks such as Laravel.
An internet exposure survey published on 21 October 2026 observed 5.48 million active services showing PHP indicators across about 3.34 million IP addresses worldwide.
The United States accounted for the largest share of those services. Other technology trackers have reported tens of millions of websites detected as running PHP. These figures cover publicly reachable systems and do not include internal or non-public installations.
PHP is commonly paired with the Apache web server, often through the mod_php module, or with PHP-FPM, a process manager used with servers such as Nginx.
Because PHP underpins a large share of public and internal web systems, a critical flaw that can be triggered by an ordinary web request has broad reach.
A meaningful share of sites continue to run older, unsupported versions of PHP that do not receive official patches from the PHP project.
Unauthenticated remote code execution means an attacker can send a request over the network to a system and cause that system to run commands of the attacker’s choosing.
No username, password, or other credentials are required. The attacker does not need an account on the target system and does not need to interact with a logged-in user.
On a web server the practical result is that the attacker can reach the server from the internet and instruct it to perform actions that the server’s normal users are not allowed to perform.
Those actions can include reading or changing files, creating new accounts, installing additional software, or using the server to reach other systems on the same network. The exact capabilities depend on the privileges of the process that runs the vulnerable software.
In the case of the two PHP flaws, researchers have shown that an ordinary web request can trigger the problem on certain common server configurations before any of the website’s own code begins to run.
Application-level controls that sit inside the website, such as login checks or input filters written by the site owner, therefore do not see the request in time to block it. Protection depends on the version of PHP that is installed and on the configuration of the web server itself.
CISA has stated that it has not observed exploitation of these flaws as of the time of publication. The absence of confirmed exploitation does not remove the exposure.
Any internet-facing or internal system running an affected version of PHP remains reachable by an attacker who sends the right request, until that system is updated to a fixed version.
