Two newly disclosed vulnerabilities could allow unauthenticated remote code execution. PHP maintainers and cybersecurity agencies are urging immediate patching.
A risk in the language runtime itself
Two security vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are forcing administrators to check the software powering their websites. PHP maintainers issued security releases on October 21, while the European cybersecurity agency ENISA joined an international warning. Under vulnerable conditions, bugs in memory management may enable unauthenticated remote code execution. Technical advisories rate the flaws critical, with a CVSS severity score of 9.2.
PHP underpins countless applications and content-management systems. Exposure therefore depends on the actual runtime version, server configuration and the components handling incoming requests, not simply the appearance of a website.
Which updates matter
Patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Unsupported releases, including PHP 8.1 and earlier, demand an upgrade path or legitimate extended-support arrangements. The maintainers have stressed that temporary workarounds are not a complete substitute for upgrading.
A practical response starts with an inventory: production sites, test environments, containers, hosting packages and management panels can all bundle PHP. Teams should compare actual versions against the vendor advisories, patch exposed workloads first, test critical functions afterwards and examine relevant security logs. Securing one machine does not prove the rest of an organisation is protected.
Severity does not mean universal compromise
A critical vulnerability disclosure is not evidence that every PHP website has already been breached. It is a reason for swift, measured defensive action. The strongest sources here are the language maintainers and cybersecurity agencies rather than viral claims.
Sources and documents
Editorial verification: based on reporting available October 22, 2026. Recheck developments before release.