PHP developers released emergency security updates on October 21, 2026, to fix two critical vulnerabilities that can allow unauthenticated remote code execution. The issues are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project said versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes and strongly urged users to update immediately. Its advisory says there are no complete alternative mitigations, making installation of the patched releases the central protective step.
The vulnerabilities received a critical rating of 9.2 under version 4.0 of the Common Vulnerability Scoring System in PHP’s advance notice. In practical terms, a successful attack could allow code to run on a vulnerable server without prior authentication. Security agencies warned that flaws of this kind can provide a route to a server’s file system or database. That does not mean every site using PHP was compromised, but it explains why authorities treated the disclosure as an urgent infrastructure risk.
Public-sector and other websites in several European countries were temporarily taken offline while administrators assessed their exposure and applied fixes. Reuters reported precautionary shutdowns involving government or public-facing services in the Netherlands, Germany, France, Belgium and Finland. The Wikimedia Foundation also said it had taken down a number of systems while work continued. Officials in several countries stressed that the outages were preventive and were not, by themselves, evidence of a confirmed breach.
CERT-EU advised affected organizations to install the new PHP releases as soon as possible. United States agencies, including the National Security Agency and the Cybersecurity and Infrastructure Security Agency, also urged immediate updates. Where an organization could not patch quickly, taking exposed systems offline was presented as the safer temporary option. Administrators must still determine whether their specific servers, configurations and applications are affected rather than assuming that every PHP deployment has the same risk.
The incident also highlights the security challenge created by the scale of PHP’s use. The language supports a large share of websites and web applications, including content-management systems and custom services. A flaw in the underlying runtime can therefore create a broad patching task across governments, companies, schools, hospitals and volunteer-run platforms. Older or unsupported PHP installations are especially problematic because they may not receive the current security releases and should be upgraded to supported branches.
PHP’s maintainers acknowledged that early signs related to one of the weaknesses had been reported in 2024, but a concrete exploitation path was not established at the time. The PHP Foundation described the delay in resolving the issue as a structural failure, according to Reuters. Researchers later used artificial-intelligence tools as part of the work that identified and analyzed the vulnerabilities, while PHP maintainers led the fixes and release process.
For operators, the verified guidance is direct: identify the PHP versions in use, update to the corresponding patched release, review exposed systems and monitor official advisories. Organizations should avoid relying on unverified workarounds or treating a service restart alone as a fix. The absence of a known incident at one organization also does not remove the need to patch, because technical details contained in released updates can help attackers study the underlying weaknesses.
