Two critical vulnerabilities in PHP, the server-side programming language used by about 70% of websites with a known server-side language, have prompted emergency patching, temporary government website shutdowns and warnings from cybersecurity agencies.
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to address CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received a CVSSv4 score of 9.2 out of 10, placing them in the system’s critical category. According to Decrypt, the flaws can allow an unauthenticated attacker to execute code remotely on an affected server.
The immediate responsibility rests with website operators, hosting companies and server administrators rather than ordinary users. Phones, browsers and personal computers do not need a PHP update because PHP generally operates on the server behind a website.
Why the vulnerabilities are serious
PHP is a programming language used to generate and operate websites from the server side. WordPress sites, for example, run on PHP servers. If an attacker can execute commands on one of those servers without logging in, the consequences can include stolen information, altered webpages or complete server takeover, GoDaddy warned.
The first vulnerability, CVE-2026-109618, involves PHP handling data after a request runs out of memory. The second, CVE-2026-109619, can leave data from one visitor’s request in memory for a later request to encounter. In the wrong circumstances, an attacker can place crafted data where PHP later interprets it as executable instructions.
The risk is particularly acute for servers using Apache’s mod_php configuration. PHP said an exploit had been demonstrated in that environment before any application code runs. That means protections built into a website, such as login controls or WordPress security plugins, may not be reached.
Researchers also identified PHP’s upload-progress feature as one confirmed route into the flaws. The feature tracks the progress of file uploads, has been enabled by default for more than a decade and is not widely used by websites.
Leak leads to early attacks and shutdowns
The PHP Foundation disclosed on October 20 that a security release containing two critical vulnerabilities was scheduled for the following day. The warning said the release could be brought forward if details became public or evidence of exploitation emerged.
That happened after vulnerability details began circulating ahead of the planned disclosure. Security company watchTowr confirmed that the flaws were real and had been under an embargo. Cloudflare CTO Dane Knecht then reported early attacks several hours before the official fix was released. Cloudflare deployed emergency web-application firewall rules for its customers, while warning that the measures were only a temporary safeguard.
Governments responded by restricting access to some public websites. Finland’s state IT center, Valtori, began taking government web services offline, while the Netherlands’ national cybersecurity agency took down its own website. France’s Interior Ministry said prefecture websites were temporarily unavailable while organizations waited for the security patch.
CERT-EU advised organizations unable to patch to consider isolating internet-facing applications from public networks. Agencies in Australia, Japan and the United Kingdom issued similar guidance, according to the source material.
Which systems are covered and what operators need to do
PHP’s official security releases cover versions 8.2 and newer. The October 21 fixes were issued for PHP 8.2, 8.3, 8.4 and 8.5. PHP also published limited source-code patches for versions 7.4, 8.0 and 8.1, while some Linux distributions were preparing their own backported fixes. PHP 8.1 and older versions do not receive regular official releases.
Security firm Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older on October 20. That represented 59% of roughly 1.5 million publicly visible hosts that identified their PHP version. A single shared-hosting server can support many websites, so the number of potentially affected sites is larger than the host count.
Website owners should confirm with their hosting provider that PHP has been updated. Wordfence warned that ordinary WordPress automatic updates will not install this server-level fix, meaning operators must identify who controls PHP on their hosting environment. PHP’s security team described patching or upgrading as the effective mitigation.
PHP 8.2 users also face a deadline: that branch is scheduled to reach end of life on December 31, 2026, after which it will receive no further security patches.
Moneyiar market picture
Moneyiar market data at the stated times showed mixed performance among the listed digital assets. AKEDO (AKE) was priced at $0.0311978718 at 23:28 on October 22, 2026, up 30.39% over 24 hours but down 6.40% over seven days. ONEchain (ONE) stood at $0.1014976406 at 23:29 on October 22, down 1.89% in 24 hours and 4.59% over seven days.
Starpower (STAR) was listed at $0.1691322256, with a 26.33% 24-hour gain and a 55.76% seven-day gain, based on Moneyiar data timestamped August 26, 2026, at 02:23. TAC Protocol (TAC) was priced at $0.0065984417, up 69.35% over 24 hours and 166.36% over seven days, according to Moneyiar data from August 27, 2026, at 09:53.
