PHP fixes two critical vulnerabilities as websites face attack risks
Government websites went offline after critical PHP flaws were disclosed
Developers of the PHP programming language have released security updates to fix two critical vulnerabilities, urging users to update immediately as website operators work to protect their systems.
Government websites in Europe and elsewhere went offline on Wednesday following the disclosure of the vulnerabilities which reported that website operators were scrambling to secure their systems, Reuters reported.
PHP underpins large parts of the internet, raising concerns that websites and other services relying on the widely used programming language could be vulnerable to attack.
Get updated faster and for FREE: Download the Gulf News app now - simply click here.
What are the PHP vulnerabilities?
The security updates address two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could cause memory corruption under certain conditions and potentially allow attackers to execute code without authentication, according to the UK National Cyber Security Centre (NCSC).
The first vulnerability involves an out-of-memory condition that can interrupt PHP while internal request data is only partially initialised. During cleanup, the system may incorrectly treat invalid data as valid.
The second involves internal request data remaining in use after the memory backing it has been freed. A subsequent request handled by the same worker could then access that stale data before normal initialisation resets it.
Both vulnerabilities were rated 9.2 under version 4 of the Common Vulnerability Scoring System (CVSS v4), according to the PHP Foundation.
Which PHP systems are at risk?
All PHP installations serving web requests could be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The PHP security team identified mod_php as the configuration facing the highest risk, citing a demonstrated exploit in which an unauthenticated request could trigger the attack before application code runs.
PHP is a server-side scripting language used to build websites and web applications. It generates dynamic content, interacts with databases and handles backend processes before delivering content to users' browsers.
PHP releases security updates
In a post on Tuesday, October 20, the PHP Foundation announced that security updates addressing the two vulnerabilities would be released at 14:00 UTC on Wednesday, October 21, 2026.
The team urged users to prepare to update, warning that the release could be brought forward if technical details became public or evidence of active exploitation emerged.
The security fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP Foundation.
Users running Linux distributions or long-term support (LTS) versions should check with their vendors for updated packages, as patches were provided in advance.
PHP 8.1 and older versions no longer receive updates directly from the PHP project. However, some distributions and LTS vendors may provide backported fixes. Users should contact their vendors for details or upgrade to a supported version.
The PHP security team also provided limited source-code backports for PHP 7.4, 8.0 and 8.1 to help users building from source or those without access to an LTS vendor.
NSA Cyber warns organisations to prepare for updates
The US National Security Agency Cybersecurity issued a warning on X, advising organisations using PHP to prepare for the security update.
The agency said the vulnerabilities could provide a path to a server's file system or database. It recommended that organisations unable to apply an update immediately consider taking affected systems offline until they could be fully mitigated.
The PHP security team cautioned that additional measures could reduce exposure to specific attack paths but would not make an installation safe. Applying the security update remains the complete solution.
