Two serious security flaws in PHP, one of the world’s most-used programming languages for websites, have alarmed website owners, businesses, and government agencies. The flaws could enable unauthorized access to some websites and servers, allowing attackers to execute malicious code with administrative privileges.
The vulnerabilities were revealed on October 21, 2026, along with the PHP development team’s security update. Security analysts and government agencies warn that businesses and government bodies should prioritize scanning their systems for the flaws and take action.
Researchers note that the flaws were found with the aid of AI, an emerging technology that plays an increasingly important role in cybersecurity.
What Are the Critical PHP Security Vulnerabilities?
The issue relates to two programming flaws in PHP’s core runtime, the software used for processing PHP code on websites.
The vulnerabilities are assigned identifiers CVE-2026-109618 and CVE-2026-109619 and have a Common Vulnerability Scoring System (CVSS) score of 9.2, according to Google Cloud.
PHP’s runtime code mishandles specific memory and application state information, increasing the possibility of “invalid internal object state” and enabling a code-execution attack, explained Google.
Code-execution vulnerabilities enable attackers to remotely control servers and devices by exploiting weaknesses that enable the execution of arbitrary commands or scripts.
Depending on the website’s or server’s configuration, attackers could infiltrate systems and steal data, disrupt operations, or conduct other malicious activities.
PHP developers released patches for the flaws, urging businesses to update their systems.
Which PHP Versions Does the Update Affect?
The problem affects PHP versions that power most websites with dynamic content. Developers note that the updates apply to PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
PHP versions starting with 5.4 and up to 8.5.11 were affected when the report was released, according to the advisory.
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released with fixes in accordance with the advisory.
Businesses should consult the PHP project’s advisory and their website host to recommend the appropriate updates.
PHP versions 8.1 and below have reached their end of life, meaning the developers do not provide further updates. It is not enough to patch PHP if the website uses containers, a separate runtime, or an embedded server. Website administrators should ensure that the updated version is actually in use.
Why Are the PHP Vulnerabilities So Serious?
PHP powers most websites, including online stores, entertainment portals, blogs, and self-hosted content platforms. It also powers hosting services that host these services and applications.
Thus, a serious problem reported in a popular programming language can affect thousands of businesses and website owners. With that said, a given website and its server setup do not necessarily pose a high risk unless it uses affected versions of PHP.
The extent of the danger depends on the website, hosting provider, applications, and their configuration.
ThePHP project warned particularly about Apache servers with mod_php, where an attacker could demonstrate a proof-of-concept attack, and the PHP-FPM application layer, where remote code execution has been shown.
For organizations whose website can process customer data or sensitive company information, the risks may be unacceptable.
U.S. Agencies and Organizations Weigh the Risks
Cybersecurity reports note that the FBI’s cybercrime branch warned about the risks of code execution in websites. The Associated Press reports that the FBI and other agencies advised taking websites offline if the website owner cannot patch the website immediately.
Some government websites have limited availability as administrators take measures to protect their systems. Such restrictions usually apply when website administrators cannot implement updates or changes in the immediate term, for example, if a vulnerability is newly discovered and the fix is not available yet.
Website owners and administrators should not mistake every website restriction for an attack. In some situations, restrictions may apply as a precautionary measure.
Depending on the situation and the website’s importance, website owners can consult the relevant parties, such as the hosting provider, before taking action.
How Did AI Help Find the PHP Vulnerabilities?
The issue demonstrates the advantages of AI systems in the field of cybersecurity. According to OpenAI, the company participated in a collaborative effort with researchers and external organizations to find and fix the flaws. Google Cloud notes that AI-powered security research also contributed to the discovery and the response to the flaws.
Exploiting a vulnerability is not a fast or easy process. An attacker must first find it, test it, and ensure that it can produce results. For serious programming errors that affect essential functions of applications, the advantages can be overwhelming.
That said, the application of AI is not a substitute for researchers and engineers. Before implementing a fix, researchers must ensure that the proposed solution actually addresses the problem. Solutions must also be implemented in production environments with caution.
The same effectiveness of AI-powered security research tools raises concerns about the ability of organizations to respond to attacks and implement protective measures in a timely manner.
What Should Website Owners Do Now?
Website administrators and business owners should treat the flaws as a high priority.
1. Check the PHP versions in use
Website administrators should ensure that all production applications, containers, and servers use the versions of PHP that have received the fixes. The current versions of PHP on local devices or development servers do not matter.
2. Update PHP versions
If a given version is affected, website administrators should update it to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the current version. If a given version of PHP is no longer supported, it is time to update the system.
3. Confirm that the version is updated
Some hosting companies use different versions of PHP for different websites or applications. Website administrators should confirm that the version is updated and that the application uses it.
In some cases, website administrators or developers may need to rebuild the application or redeploy it with the updated version of PHP.
4. Scan for unusual activity
Website administrators should review system logs for unusual or unauthorized activities that may indicate that attackers have already infiltrated the system. Updating PHP helps protect against attacks using the described vulnerabilities, but it does not eliminate all risks.
For example, if an attacker has already infiltrated the system, exploited the vulnerability, and established persistence, website administrators will need to deal with the aftermath. It is also important to ensure that website administrators do not have unnecessary access rights.
5. Consider permissions and access rules
Website administrators should conduct an audit of permissions and access rules to ensure that applications do not have excessive rights. They should also review multifactor authentication rules for administrative accounts to ensure that multifactor authentication is enabled and that credentials are not compromised.
6. Consult the hosting provider
If website administrators cannot manage PHP versions themselves, they should contact the technical support of the company that hosts the website. Website administrators should ask the support to confirm that the necessary updates have been implemented.
If the website is temporarily unavailable and website administrators cannot update PHP, they should consult technical support and consider restricting access to the website or application.
What Does It Mean for Business and WordPress Websites?
Vulnerable PHP versions apply to all websites that use PHP, including small websites and large-scale applications. For businesses, that means ensuring that their website or application is not at risk.
Most businesses use WordPress to power their website. Website administrators should ensure that the WordPress version is up-to-date and that the service provider uses a secure version of PHP.
While WordPress is not explicitly at risk, businesses should ensure that they update their software and that the hosting company has taken the necessary steps to update PHP.
Smaller organizations may need to consult their hosting provider to ensure that they are using the correct version of PHP. Website administrators should also request that the company update PHP and take other necessary measures.
Regardless of the website’s size, it is important to ensure that there are measures in place to update and maintain the software. Website administrators should also have documented procedures for responding to attacks and other incidents. Website administrators should also have working backups of the website and applications, although backups are usually not enough to ensure cybersecurity.
The Bottom Line
The PHP vulnerabilities that were discovered on October 21, 2026, remind businesses and website owners of the potential risks of vulnerabilities and poor maintenance.
The flaws could allow attackers to infiltrate systems with full administrative privileges, which could lead to data breaches and other issues. Website owners should update their systems and ensure that website visitors are not at risk.
As programming flaws become harder to detect, the use of AI to find and address them is the best option. That said, companies must respond quickly to address the flaws.
Two serious security flaws in PHP, one of the world’s most-used programming languages for websites, have alarmed website owners, businesses, and government agencies. The flaws could enable unauthorized access to some websites and servers, allowing attackers to execute malicious code with administrative privileges.
The vulnerabilities were revealed on October 21, 2026, along with the PHP development team’s security update. Security analysts and government agencies warn that businesses and government bodies should prioritize scanning their systems for the flaws and take action.
Researchers note that the flaws were found with the aid of AI, an emerging technology that plays an increasingly important role in cybersecurity.
What Are the Critical PHP Security Vulnerabilities?
The issue relates to two programming flaws in PHP’s core runtime, the software used for processing PHP code on websites.
The vulnerabilities are assigned identifiers CVE-2026-109618 and CVE-2026-109619 and have a Common Vulnerability Scoring System (CVSS) score of 9.2, according to Google Cloud.
PHP’s runtime code mishandles specific memory and application state information, increasing the possibility of “invalid internal object state” and enabling a code-execution attack, explained Google.
Code-execution vulnerabilities enable attackers to remotely control servers and devices by exploiting weaknesses that enable the execution of arbitrary commands or scripts.
Depending on the website’s or server’s configuration, attackers could infiltrate systems and steal data, disrupt operations, or conduct other malicious activities.
PHP developers released patches for the flaws, urging businesses to update their systems.
Which PHP Versions Does the Update Affect?
The problem affects PHP versions that power most websites with dynamic content. Developers note that the updates apply to PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
PHP versions starting with 5.4 and up to 8.5.11 were affected when the report was released, according to the advisory.
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been released with fixes in accordance with the advisory.
Businesses should consult the PHP project’s advisory and their website host to recommend the appropriate updates.
PHP versions 8.1 and below have reached their end of life, meaning the developers do not provide further updates. It is not enough to patch PHP if the website uses containers, a separate runtime, or an embedded server. Website administrators should ensure that the updated version is actually in use.
Why Are the PHP Vulnerabilities So Serious?
PHP powers most websites, including online stores, entertainment portals, blogs, and self-hosted content platforms. It also powers hosting services that host these services and applications.
Thus, a serious problem reported in a popular programming language can affect thousands of businesses and website owners. With that said, a given website and its server setup do not necessarily pose a high risk unless it uses affected versions of PHP.
The extent of the danger depends on the website, hosting provider, applications, and their configuration.
ThePHP project warned particularly about Apache servers with mod_php, where an attacker could demonstrate a proof-of-concept attack, and the PHP-FPM application layer, where remote code execution has been shown.
For organizations whose website can process customer data or sensitive company information, the risks may be unacceptable.
U.S. Agencies and Organizations Weigh the Risks
Cybersecurity reports note that the FBI’s cybercrime branch warned about the risks of code execution in websites. The Associated Press reports that the FBI and other agencies advised taking websites offline if the website owner cannot patch the website immediately.
Some government websites have limited availability as administrators take measures to protect their systems. Such restrictions usually apply when website administrators cannot implement updates or changes in the immediate term, for example, if a vulnerability is newly discovered and the fix is not available yet.
Website owners and administrators should not mistake every website restriction for an attack. In some situations, restrictions may apply as a precautionary measure.
Depending on the situation and the website’s importance, website owners can consult the relevant parties, such as the hosting provider, before taking action.
How Did AI Help Find the PHP Vulnerabilities?
The issue demonstrates the advantages of AI systems in the field of cybersecurity. According to OpenAI, the company participated in a collaborative effort with researchers and external organizations to find and fix the flaws. Google Cloud notes that AI-powered security research also contributed to the discovery and the response to the flaws.
Exploiting a vulnerability is not a fast or easy process. An attacker must first find it, test it, and ensure that it can produce results. For serious programming errors that affect essential functions of applications, the advantages can be overwhelming.
That said, the application of AI is not a substitute for researchers and engineers. Before implementing a fix, researchers must ensure that the proposed solution actually addresses the problem. Solutions must also be implemented in production environments with caution.
The same effectiveness of AI-powered security research tools raises concerns about the ability of organizations to respond to attacks and implement protective measures in a timely manner.
What Should Website Owners Do Now?
Website administrators and business owners should treat the flaws as a high priority.
1. Check the PHP versions in use
Website administrators should ensure that all production applications, containers, and servers use the versions of PHP that have received the fixes. The current versions of PHP on local devices or development servers do not matter.
2. Update PHP versions
If a given version is affected, website administrators should update it to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the current version. If a given version of PHP is no longer supported, it is time to update the system.
3. Confirm that the version is updated
Some hosting companies use different versions of PHP for different websites or applications. Website administrators should confirm that the version is updated and that the application uses it.
In some cases, website administrators or developers may need to rebuild the application or redeploy it with the updated version of PHP.
4. Scan for unusual activity
Website administrators should review system logs for unusual or unauthorized activities that may indicate that attackers have already infiltrated the system. Updating PHP helps protect against attacks using the described vulnerabilities, but it does not eliminate all risks.
For example, if an attacker has already infiltrated the system, exploited the vulnerability, and established persistence, website administrators will need to deal with the aftermath. It is also important to ensure that website administrators do not have unnecessary access rights.
5. Consider permissions and access rules
Website administrators should conduct an audit of permissions and access rules to ensure that applications do not have excessive rights. They should also review multifactor authentication rules for administrative accounts to ensure that multifactor authentication is enabled and that credentials are not compromised.
6. Consult the hosting provider
If website administrators cannot manage PHP versions themselves, they should contact the technical support of the company that hosts the website. Website administrators should ask the support to confirm that the necessary updates have been implemented.
If the website is temporarily unavailable and website administrators cannot update PHP, they should consult technical support and consider restricting access to the website or application.
What Does It Mean for Business and WordPress Websites?
Vulnerable PHP versions apply to all websites that use PHP, including small websites and large-scale applications. For businesses, that means ensuring that their website or application is not at risk.
Most businesses use WordPress to power their website. Website administrators should ensure that the WordPress version is up-to-date and that the service provider uses a secure version of PHP.
While WordPress is not explicitly at risk, businesses should ensure that they update their software and that the hosting company has taken the necessary steps to update PHP.
Smaller organizations may need to consult their hosting provider to ensure that they are using the correct version of PHP. Website administrators should also request that the company update PHP and take other necessary measures.
Regardless of the website’s size, it is important to ensure that there are measures in place to update and maintain the software. Website administrators should also have documented procedures for responding to attacks and other incidents. Website administrators should also have working backups of the website and applications, although backups are usually not enough to ensure cybersecurity.
The Bottom Line
The PHP vulnerabilities that were discovered on October 21, 2026, remind businesses and website owners of the potential risks of vulnerabilities and poor maintenance.
The flaws could allow attackers to infiltrate systems with full administrative privileges, which could lead to data breaches and other issues. Website owners should update their systems and ensure that website visitors are not at risk.
As programming flaws become harder to detect, the use of AI to find and address them is the best option. That said, companies must respond quickly to address the flaws.
