PHP Vulnerability 2026: Critical Security Alert for CVE-2026-109618 and CVE-2026-109619

What is the critical security alert for PHP in October 2026?

The critical security alert PHP published on 2026-10-21 covers two remote code execution flaws in the PHP engine: CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (stale request state reused across requests). An attacker needs no account and no session. The PHP project states there are no complete mitigations and that updating is the only safe choice.

These PHP security vulnerabilities sit in memory management and error handling, code paths that nearly every request touches. That placement is why they’re serious and why the fix took from August to October to ship without breaking extensions, according to the PHP Foundation (2026-10-21). Two scores circulate. The PHP project assigned CVSS v4.0 9.2 to each CVE. NVD scores both 9.8 on CVSS v3.1 because the older scale has no “attack requirements” metric to discount the memory-pressure precondition. A leaked 10.0 figure from 2026-10-20 was wrong, per the PHP Foundation.

The UK’s NCSC titled its advisory critical security issue affecting PHP (2026-10-21) and gave one blunt instruction: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”a generative model’s parametric memory with an external, searchable non-parametric memory. In practical systems today, the term is used more broadly for applications that retrieve evidence before generating an answer (Lewis et al., 2020).

Which PHP versions are affected, and which are fixed?

Every PHP installation serving web requests is affected until it runs PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, per the PHP security advisory (2026-10-21). That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team also published minimal source backports for PHP 7.4, 8.0, and 8.1, but no binary releases for those branches.

How far back the exposure reaches depends on who you ask. PHP’s advisory lists only the supported branches. Calif and Wiz (2026-10-21) trace the earliest affected path to PHP 5.4.0, released in 2012. Australia’s ACSC alert (2026-10-21, updated 2026-10-22) says all PHP versions from PHP 5 onward may be affected [VERIFY: cited from a cached copy; cyber.gov.au unreachable at time of writing]. Treat anything older than 8.2 as exposed with no vendor binary coming.

How do you check which PHP version your website runs?

Check the PHP version the web server executes, not the one on the command line. On a server, php -v reports the CLI binary, which can differ from the PHP-FPM pool or mod_php module serving traffic. Put a one-line phpinfo() file behind an allowlist, load it over HTTP, read the version and the Server API line, then delete the file.

Four places to look, in order of how often they’re missed:

1. Managed hosting and control panels. cPanel and Plesk let each site pick its own PHP version. Check per site, and ask the provider for the patched package version in writing.
2. Containers. The image tag (php:8.3-fpm) tells you the branch, not the patch level. Pull the latest digest, run php -v inside it, and redeploy.
3. Appliances and bundled PHP. The NCSC advises monitoring “appliances and services that may bundle PHP”: monitoring dashboards, VoIP admin panels, vendor products that never advertise PHP. NCSC-NL maintains an inventory list.
4. Your build pipeline. A CI runner on an old base image can rebuild a patched image back to an unpatched one.

This step is where most teams lose a day. If nobody can say which PHP version production serves, that gap is itself a finding, and the pattern is familiar from legacy systems nobody understands.

How do you update PHP safely in five steps?

Update the PHP runtime to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart every worker, and confirm the served version. The whole sequence takes an afternoon on a well-inventoried fleet. EDIS Global shut its Control Panel and APIs at 12:33 UTC on 2026-10-21 and restored them at 15:41 UTC, about two hours after the fix shipped, per its status page (2026-10-21).

1. Inventory every PHP runtime: hosts, containers, build images, control panels, and bundled PHP in vendor products.
2. Apply the PHP update from your distribution, LTS vendor, or source. Linux distributions received the patches in advance, per php.net; the volunteer remirepo.net repository had no update on release day.
3. Restart or redeploy. PHP-FPM pools, Apache, LiteSpeed, and containers all need a restart so the new binary loads. A patched package with a running old worker is still exploitable.
4. Verify the SAPI version, not the CLI version, with a temporary phpinfo() page you delete afterward.
5. Review logs for pre-patch activity and record what changed, when, and who verified it.

If you can’t patch today, isolate. CERT-EU (2026-10-21) recommends isolating internet-facing resources from public networks until the fix is applied and verified. The partial mitigations php.net lists (memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0) reduce exposure to specific paths and do not make an installation safe.

What is PHP2Shell, and how do the two PHP vulnerabilities work?

PHP2Shell is the name Wiz gave the combined exploit script that chains both CVEs into one unauthenticated attack, per php2shell.com (2026-10-21). The name spread on 2026-10-20 after Calif mistakenly published a proof-of-concept video following the leak, a day before the advisories landed, per the PHP Foundation. It isn’t malware you can scan for. It’s a demonstration that the bugs are reachable with default settings.

CVE-2026-109618 works through memory pressure. If a request hits PHP’s memory_limit at the wrong moment, PHP leaves partially initialized request data behind and later treats it as valid, corrupting memory. On Apache with mod_php, one unauthenticated request triggers this before any application code runs, per the PHP Foundation (2026-10-21). CVE-2026-109619 is a use-after-free: a fatal error at the wrong point leaves internal state pointing at memory from a previous request, and the next request on the same worker reuses it. The first bug can also leak process memory into a PHPSESSID response cookie, Heartbleed-style, exposing passwords and session data (Sansec, 2026-10-21).

Both research teams used frontier AI models to find the bugs, per the PHP Foundation and Wiz. Wiz estimates “roughly 70%” of the internet runs PHP, a figure the BBC (2026-10-22) says it is unable to verify.

Is the PHP vulnerability being exploited in the wild?

Attack attempts are confirmed at scale; confirmed breaches are not, as of 2026-10-22. Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the ten hours before the announcement, rising to “millions now” by late 2026-10-21, per SBS News (2026-10-22). The PHP Foundation, by contrast, “did not identify any functional exploits at the time of release.”

The sources disagree on degree. ENISA’s joint EU statement (2026-10-21) refers to “the active exploitation.” Cloudflare CTO Dane Knecht told the BBC he was “seeing early attacks emerging and are updating mitigations as new vectors show up.” Amazon saw an exploit attempt against a honeypot days before disclosure, per SBS. Australia’s ACSC is not aware of successful exploitation within Australia. Sansec told merchants to “expect mass exploitation now that the patch and the writeups are public” (2026-10-21).

The practical reading: attempts are automated and global, and nobody can tell you your server wasn’t one of the successes. Don Smith of Sophos told the BBC the hard part isn’t installing the patch but finding every PHP instance. Organisations should look for signs an attacker “might have already gained a foothold.” Wiz’s detection signals: unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, oversized or malformed PHPSESSID response cookies, and unexplained PHP worker crashes.

Why did websites go offline worldwide, and what did the timeline look like?

PHP websites down across three continents were a precaution, not a breach wave: agencies told operators who couldn’t patch immediately to disconnect, and large operators took that advice. Finland’s state IT provider Valtori shut down government public web services, the Netherlands’ NCSC took its own site offline, and Edinburgh council and several BBC programme pages became inaccessible, per the BBC (2026-10-22).

The NSA, as reported by the BBC, told organisations on X to take systems offline if they couldn’t update. Its reasoning: “These vulnerabilities often provide a direct path to the server’s file system or database.”

Wikimedia took “a number of other systems” down, and the Internet Archive briefly went offline, per the BBC and SBS. Denmark’s Kombit and France’s Interior Ministry took services down too, per ABC News/Reuters (2026-10-22). With so many PHP websites down, the pattern that worked was read-only behind a CDN: visitors kept getting pages while origins stayed unreachable.

Australia government websites PHP vulnerability: what actually happened?

Australian government websites went offline as a precaution, not because of a breach. Industry and Innovation Minister Tim Ayres said no Australian government websites had been breached and the takedowns were preventative, per SBS (2026-10-22). The ASD’s ACSC issued a critical alert, confirmed cyber.gov.au itself was among the affected sites, and stated it was not aware of successful active exploitation within Australia.

The mechanism was GovCMS, the Department of Finance platform behind more than 300 government sites [VERIFY: 300+ figure is from Func Digital, a secondary source]. At 19:00 AEDT on 2026-10-21, GovCMS disabled direct access to its origin, “heeding advice from cyber.gov.au,” and served public content from Akamai’s cache overnight while editors lost login access, per the GovCMS status page (2026-10-21). By 12:58 AEDT on 2026-10-22, two-thirds of sites were patched with editing restored. Some NSW government sites and, briefly, the Parliament of Australia site were also down, per SBS.

The Australia government websites PHP vulnerability story is a case study in cheap caution: static content stayed readable, the exposed surface dropped to zero for about 14 hours, and the cost was a night without content editing.

Does updating WordPress, Drupal, or Magento fix the PHP vulnerability?

Updating WordPress, Drupal, Magento, or any plugin does nothing for this PHP issue, because the flaw sits in the PHP engine below the application. Calif demonstrated unauthenticated code execution against WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, Laravel 13.11, and Symfony 8.1, among others, per Sansec (2026-10-21). A fully current CMS on an unpatched PHP runtime is fully exploitable.

CMS maintenance mode doesn’t help either. PHP parses each request before WordPress or Magento checks its maintenance flag, so a “down for maintenance” page on an unpatched runtime is still a live target, per Sansec. For a PHP WordPress stack on shared hosting, the fix is the host’s package update plus a PHP-FPM restart; ask for the package version, then confirm it yourself. For a PHP WordPress or Magento install you operate, the PHP update is yours to apply.

A WAF buys time, not safety. Cloudflare’s Knecht called its rules “a STOPGAP only. Patch as soon as PHP releases the update,” per ABC News (2026-10-22). Sansec’s rule blocks multipart/form-data, which also breaks product-image uploads in Magento admin.

What should regulated companies log for auditors?

Regulated companies should keep a dated remediation record for every PHP runtime: the host or image, the version before and after, the restart time, who verified the served version, and the log review result. Banks, insurers, and healthcare providers answer to breach-notification rules, so this PHP issue raises audit questions as well as technical ones. Build the record as you patch, not afterward.

Three items auditors under SOC 2, PCI DSS, DORA, or NIS2 will ask for:

• Evidence of the served version, not the installed package: a timestamped phpinfo() capture, filed next to each application release.
• A pre-patch compromise assessment. The NCSC says that if you couldn’t update immediately, you should “assess the system for any evidence of compromise prior to your upgrade.” Record the signals you checked and the window you covered.
• The exception list. Every runtime on 7.4, 8.0, or 8.1 with a source backport or vendor patch, with an owner and a retirement date.

Under the EU Cyber Resilience Act, manufacturers have had to report actively exploited vulnerabilities since 2026-09-11, per ENISA (2026-10-21). If you ship a product that bundles PHP, that clock may already be running. A SOC 2-ready engineering process produces this evidence by default.

How does Teamvoy respond to the PHP vulnerability for clients?

Teamvoy runs a four-stage response to the PHP vulnerability 2026 for clients on PHP: inventory in the first hour, patch and verify by hour four, log review on day one, and a branch-by-branch decision on day two. The windows below are the playbook, not a results claim; Teamvoy hasn’t published first-party numbers for this incident.

The first hour matters more than the patch itself. Sophos told the BBC that PHP “can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.” A structured IT audit answers the same question in calmer weeks. Our assessment of a vibe-coded application shows the shape of the evidence we produce. Day 2 is where a critical security alert PHP incident stops being a security ticket and becomes an engineering decision.

When does the PHP patch become a modernization project?

The PHP update becomes a modernization project only when your inventory shows applications on PHP 7.4, 8.0, or 8.1 with no vendor-supplied binary and a source backport your team can’t build, test, and maintain. For everything else, the right move this week is to patch or isolate; a modernization engagement is the wrong response to a 48-hour incident.

That cuts against our own commercial interest, so here it is plainly. Most of your fleet is on a supported branch and needs a package update and a restart. Taking a site read-only behind a CDN, the GovCMS pattern, buys days at near-zero cost. Neither is a project.

The exception is the app on 8.1 or older. Those branches “no longer receive updates,” per the PHP project, and the backports exist “to help people building from source or without access to an LTS vendor.” Building PHP from a patched source once is a day’s work. Doing it for every future PHP vulnerability, across a fleet, with an extension stack that may not compile, is the ongoing tax the hidden costs of legacy systems describe. If the Day 2 list has more than a handful of entries, that list is your modernization backlog, and the PHP vulnerability 2026 exposure window is its business case. Scope it through application modernization only after the patch is verified and the compromise assessment is filed.

Conclusion

The PHP vulnerability 2026 alert is a runtime problem, so the fix is a runtime update: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, a restart on every worker, and a check of the version your web server serves. Do that this week, and isolate what you can’t patch. The decision that outlasts the news cycle comes on Day 2, when your inventory shows which applications sit on branches with no binary fix. That list, not the CVE, tells you whether you have a patch or a project. Talk to Teamvoy About Application Modernization: If your Day 2 list has applications on PHP 7.4, 8.0, or 8.1 with no vendor binary, that’s the scope we’d start with: runtime inventory, a tested path to a supported branch, and an auditor-ready record of the move. Start with a conversation about application modernization.

FAQ