Today, 21 October 2026, the PHP team published a security advisory that should not wait until next week: a critical PHP vulnerability (two of them, in fact) allows remote code execution on the server without logging in. It affects virtually any website, online store, intranet or API that runs on PHP, which includes most sites built with WordPress, Laravel, Symfony, Drupal, PrestaShop or Magento.
If your business depends on a PHP platform and you don't know for sure which version your server runs, who is in charge of updating it or whether your vendor has already reacted, this article is for you. We explain in plain language what happened with this critical PHP vulnerability, how to tell whether you are exposed and what you can do today, whether or not you have your own technical team.
In short: PHP has fixed two flaws rated 9.2 out of 10 that can let an attacker take over a server with a single web request. The only complete fix is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your site runs PHP 8.1 or older, it no longer receives official patches and the risk is even higher. At MiTSoftware we offer a free check to find out in minutes whether your platform is exposed.
What this critical PHP vulnerability is and why it is so serious
The official advisory published in the PHP.net news archive describes two separate flaws, tracked as CVE-2026-109618 and CVE-2026-109619. One day earlier, the PHP security team had already announced that both carried a CVSS score of 9.2, a level reserved for the most serious problems.
Without getting too technical, both flaws have something in common: they exploit situations in which PHP mishandles memory between one request and the next. An attacker can trigger those situations from the outside and, in the worst case, get the server to run whatever code they want. That means access to your customer database, orders and passwords, and the ability to install malware or use your server to attack others.
What makes this critical PHP vulnerability especially dangerous is that it needs no username or password and, in some setups, the attack happens before your application code even runs. In other words, it does not matter how well your website is built: the problem lies in the foundation it runs on.
Who is affected (and why that probably includes you)
According to the advisory, every PHP installation that serves web requests is at risk, however it is set up: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. The PHP team considers the risk highest on servers running Apache with mod_php, a very common setup on shared hosting and older servers.
In practice, you should consider yourself affected if:
- Your corporate website or blog runs on WordPress, Drupal or Joomla.
- Your online store uses WooCommerce, PrestaShop or Magento.
- Your custom platform, intranet or API is built with Laravel, Symfony, CodeIgniter or plain PHP.
- You have an admin panel, CRM or internal ERP that was built in PHP years ago.
There is also a group that should be twice as worried: anyone still on PHP 8.1, 8.0 or 7.4. Those versions no longer receive official updates from the PHP project. Given the severity, the security team has published minimal patches for people who build PHP themselves, but there will be no ready-to-install packages. And PHP 8.2 stops receiving security fixes on 31 December 2026, as shown in the PHP.net supported versions table. Many companies sit right in that window without realizing it.
What to do today: the 10-minute checklist
Before panicking, it helps to sort out priorities. This is the checklist we use with our clients on the same day an advisory like this comes out:
- Find out which PHP version your server runs. Your hosting provider or technical team should be able to tell you within minutes. If nobody knows, that is already an important finding.
- Check whether a patched version exists for your setup. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions and extended support vendors received the patches in advance, so many already have them available.
- Request the update in writing, with a date. If you work with an external vendor, ask for confirmation that the server has been updated and that every PHP process has been restarted.
- Make sure the website still works after updating: forms, payments, private areas and scheduled tasks.
- If you cannot update today, apply temporary measures (see below) and set a near date to do it.
- If you are on PHP 8.1 or older, plan a migration now. Staying there means leaving the door open.
If any of these steps has no clear answer in your company, you are not alone: it is the most common situation we find when we run a preventive security audit.
If you cannot update today: temporary measures
The PHP team itself insists that updating is the only complete fix. Even so, it suggests some measures that reduce exposure while the update is being prepared, for example:
- Disabling the session upload progress feature (
session.upload_progress.enabled=0) and restarting every PHP worker. - Lowering the maximum request size the server accepts (
post_max_size) and limiting, at the web server or proxy level, the number of fields, headers and parts in each request. - On PHP 8.5, turning off backtraces on fatal errors (
fatal_error_backtraces=0). - Fixing fatal errors and timeouts that an attacker could trigger, for instance in imports or file uploads.
These measures require careful changes to the server configuration: a badly applied change can break file uploads, payment gateways or integrations. They are a stopgap for hours or days, not a solution.
The underlying problem: PHP platforms with no technical owner
Every time a critical PHP vulnerability appears, we see the same pattern. The flaw itself gets fixed quickly; what takes weeks is figuring out who has access to the server, what depends on which version and whether updating will break something. Websites built years ago by a freelancer who is long gone, hosting accounts nobody checks, plugins nobody updates or applications still on PHP 7.4 because "they work".
That is the real risk: not today's news, but having nobody who can respond within hours. With PHP 8.2 reaching the end of its support in December and PHP 8.6 about to be released, the coming months will demand decisions about versions, compatibility and maintenance. If your platform carries old code, you may want to see how we approach modernizing legacy systems without slowing your business.
How MiTSoftware helps you fix it
We have spent years working on PHP projects of every size, from corporate websites to custom platforms with thousands of users. When an advisory like today's comes out, our work follows three phases:
- Exposure check: we identify which PHP version each of your servers runs, how it is configured and what real risk you face from these two flaws.
- Safe update: we apply the patched version or the right temporary measures, test the critical flows of your website and document everything we did.
- Mid-term plan: if you are on PHP 8.2 or older, we propose a migration plan to a supported version, in phases and without stopping your operations, backed by our web development team.
And if you are looking for more than putting out this fire, it is worth understanding the difference between a Git audit and a code audit, so the next advisory does not catch you off guard.
Frequently asked questions
Doesn't my hosting provider handle this automatically? It depends on the type of service. Managed shared hosting usually updates the PHP version, but on VPS, dedicated or cloud servers the responsibility almost always lies with you or your development vendor. It is worth confirming in writing.
Can updating PHP break my website? Moving to a patched release within the same branch (for example, from 8.3.35 to 8.3.36) rarely causes problems. Switching branches (from 7.4 to 8.3, for example) does require reviewing the code and plugins first.
My WordPress is up to date, am I safe? Not necessarily. This flaw is in PHP, not in WordPress. You can have the latest WordPress and every plugin updated and still be exposed if the server runs an unpatched PHP version.
How long does the check take? In most cases, a first exposure review takes a few hours and already tells you whether you need to act today or can wait for a maintenance window.
Free check: is your PHP platform exposed?
You don't need to wait for an incident to know where you stand. We offer a free 30-minute check session: we review with you your server's PHP version, its configuration and the real risk from this vulnerability, and tell you, with no commitment, what you should do today and what can wait.
