PHP Rushes Emergency Patches for Two Critical Flaws: What U.S. Site Owners Must Do Now
PHP has released emergency updates for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. U.S. businesses should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away.
Date: Wednesday, October 21, 2026 · Time: 2:10 PM EDT
PHP has released emergency updates for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. U.S. businesses should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away.
PHP powers a huge share of websites, from small business pages to online stores. When its developers call a security release “critical,” anyone running a PHP-based site needs to pay attention. That is the situation today.
What Happened
On October 20, details of two serious PHP bugs leaked online before the planned disclosure. The PHP security team had scheduled its fix for October 21 at 14:00 UTC, and it shipped the patched versions on Wednesday. Security researchers are calling the pair “PHP2Shell.”
Both flaws carry a CVSS v4.0 score of 9.2, which is rated critical. Cloudflare has reported attack traffic aimed at them, including attempts to dodge its protections. Security firm Sansec also warned that mass attacks could begin within minutes of release.
What the Flaws Do
Both bugs allow unauthenticated remote code execution. In plain terms, an attacker may be able to run commands on your server without logging in.
CVE-2026-109618: Out-of-Memory Corruption
When a memory shortage interrupts a vulnerable operation, PHP can leave request data partly initialized, creating an opening for attackers.
CVE-2026-109619: Stale Global State
PHP can keep pointing to request data after its memory has already been freed, which attackers may abuse.
According to the PHP team, any installation serving web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers at Wiz say affected versions reach back to PHP 5.4, so teams on retired branches should plan an upgrade, since the fixes target the current branches below.
Which Versions Fix the Problem
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to patch immediately. PHP’s own security advisory lists the full details.
What U.S. Businesses Should Do Today
- Find your PHP. Check your hosting plan, content management system, online store and any custom apps.
- Update or ask your host. Managed hosts may patch for you, so confirm in writing.
- Restart services. Updated PHP files do not help until PHP-FPM or Apache is restarted.
- Watch your logs. Look for odd requests or new, unfamiliar files.
- Verify backups. Keep clean copies off-server, as explained in our guide to cloud backups over local storage.
Unsupported or abandoned plugins are a common weak spot, so review the hidden risks of free business software. If you suspect a break-in, follow our steps for handling a data breach as a small business.
Conclusion
The fixes are out, and attackers are already looking for unpatched servers. Update, restart, and verify. Skipping it risks a full server takeover.
Author’s Review
I have followed PHP security releases for years, and this one stands out. Leaked details, a 9.2 score and no login needed make it a true emergency. My advice is simple: do not wait for the weekend. Many small business owners assume their host handles everything, but I would still ask for confirmation. A five-minute check today is far cheaper than cleaning up a hacked site next week.
Elena Rostova
B2B Operations Consultant & Business Editor
Elena Rostova is a B2B strategy consultant specializing in digital operations, regulatory risk management, and scaling business models. She writes on corporate licensing, operational frameworks, and enterprise growth.
