On October 21, 2026, the PHP security team released an emergency update to address two critical vulnerabilities affecting one of the most widely used programming languages on the Internet.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have received a severity score of 9.2 out of 10 under the CVSS 4.0 scoring system. Under certain conditions, these flaws could allow attackers to execute malicious code on a server without authentication.
The potential impact is significant. PHP powers numerous business applications, corporate websites, e-commerce platforms and content management systems such as WordPress, Drupal and Joomla.
For businesses, this incident raises an immediate question: do we really know which servers and applications are running PHP, and whether they are up to date?
In this article, we explain what happened, which versions are affected and what measures organizations should take to protect their IT infrastructure.
What Happened to PHP Security?
PHP is a programming language used to run web applications, process forms, manage user sessions and connect websites to databases, among many other functions.
The newly discovered problem is not related to a specific website or WordPress plugin. Instead, it affects internal components of the PHP language itself.
Both vulnerabilities involve memory management and the handling of certain errors during PHP execution.
Under specific circumstances, an attacker could exploit these flaws to manipulate server behavior and execute unauthorized instructions.
CVE-2026-109618: Memory Corruption
This vulnerability is related to how PHP handles certain situations in which a memory limit is reached.
When this type of error occurs, some internal data may remain partially initialized and subsequently be used incorrectly.
The security team has confirmed that remote code execution through unauthenticated requests has been demonstrated in Apache environments using mod_php. Exploitation has also been confirmed in PHP-FPM through specific application execution paths.
CVE-2026-109619: Internal State Not Properly Reset
The second vulnerability affects internal information that may remain referenced after the corresponding memory has been released.
If a subsequent request uses this incorrect state, memory corruption could occur and potentially be exploited by an attacker.
In both cases, these vulnerabilities can affect the underlying server, rather than being limited to the web application running on it.
Which PHP Versions Are Affected?
On October 21, the official PHP team released four updated versions containing the necessary security fixes.
The patched versions are:
- PHP 8.5: update to version 8.5.12 or later.
- PHP 8.4: update to version 8.4.27 or later.
- PHP 8.3: update to version 8.3.36 or later.
- PHP 8.2: update to version 8.2.35 or later.
Installations running older releases within these branches should be considered affected unless the corresponding security patches have already been applied.
The situation is particularly concerning for PHP 8.1 and earlier versions, which are no longer officially supported by the PHP project. Some vendors provide specific fixes through extended support agreements, but these must be verified individually.
In addition, official security support for PHP 8.2 will end on December 31, 2026, making it advisable to plan a migration to a version with a longer remaining support lifecycle.
It is important to remember that some Linux distributions backport security patches without necessarily changing the main PHP version number. Therefore, checking the output of php -v alone does not always establish whether a system is protected.
Why Do These Vulnerabilities Pose a Risk to Businesses?
A vulnerability that enables remote code execution can have serious consequences, especially when the affected server is connected to the Internet.
Depending on the permissions of the compromised process and the security measures in place, an attacker could attempt to:
- Access information stored or processed by business applications.
- Manipulate server files and components.
- Disrupt business services and operations.
- Install malicious tools or establish persistent access.
- Use the compromised system as a starting point for further attacks.
This does not mean that every PHP installation has been compromised. It means that organizations running vulnerable versions must assess their exposure and take prompt action.
The level of risk also depends on server configuration, the technology used to execute PHP and the isolation measures implemented.
WordPress, Business Applications and Servers: Where Does the Risk Lie?
Many organizations use PHP without being fully aware of it. The technology is not limited to corporate websites.
PHP can also be found in management platforms, internal applications and third-party software products.
Corporate Websites and Online Stores
WordPress, Drupal, Joomla and many e-commerce platforms rely on PHP to run part of their functionality.
Even if the content management system and its extensions are fully updated, the server may still be running a vulnerable version of PHP.
For this reason, updating WordPress is not the same as updating PHP. They are separate components and require independent security checks.
Business Applications
Some document management, inventory, monitoring and administration tools use PHP as part of their underlying architecture.
In these environments, IT departments should verify whether the software vendor has released an update or whether dependencies could prevent the immediate installation of a patched version.
Servers and Docker Containers
Virtualization and containerized environments introduce another challenge: PHP may be embedded within a Docker image that is not automatically updated alongside the host operating system.
A company could have a fully updated Linux server while still running a Docker container containing a vulnerable version of PHP.
Organizations should therefore also review container images, their dependencies and the update policies applied to production workloads.
What Should Businesses Do to Protect Their PHP Servers?
When vulnerabilities of this severity are disclosed, organizations must respond quickly while following a structured process to avoid unnecessary disruption to critical services.
These are the measures we recommend prioritizing.
1. Identify All Systems Running PHP
The first step is to locate every PHP installation, including physical servers, virtual machines, web hosting environments, internal applications and containers.
Particular attention should be paid to Internet-facing services and systems that process sensitive business information.
2. Check Installed Versions and Security Patches
Knowing the main PHP version is not enough. Organizations must also verify whether installed packages include the security fixes released by PHP or by their Linux distribution vendor.
For externally managed systems, it is advisable to request confirmation from the service provider regarding the patched versions and their installation dates.
3. Apply Security Updates
The official recommendation is to install a patched PHP release as soon as possible.
For systems using unsupported versions, organizations should determine whether extended maintenance provides the necessary security patches or plan a migration to a supported release.
Temporary mitigation measures may reduce certain attack vectors, but the PHP security team has warned that they are not a replacement for installing the official fixes.
4. Verify Application Compatibility
Updating PHP can affect legacy applications, libraries, extensions and custom-developed software.
Whenever feasible, changes should be validated in a testing environment before being deployed to production, without unnecessarily delaying fixes for exposed systems.
A well-planned update should include verified backups, functional testing and a recovery procedure in case compatibility issues arise.
5. Review Logs and Suspicious Activity
Installing a security patch fixes the vulnerability, but it does not prove that the server was not previously compromised.
For potentially exposed systems, organizations should examine web server logs, PHP error logs, unexpected processes and suspicious file modifications.
If indicators of compromise are identified, an incident response procedure should be initiated before considering the remediation process complete.
6. Maintain an Ongoing Update Policy
This incident highlights the importance of maintaining an accurate IT asset inventory and established procedures for deploying security updates.
Organizations should not have to wait for an international security alert to discover that a business application is running an outdated software version.
A professional IT maintenance service for businesses can help organize these checks, manage updates and coordinate maintenance activities across critical systems.
Is a Firewall Enough to Prevent These Attacks?
Firewalls and web application protection solutions can help reduce exposure to certain attacks, but they do not eliminate vulnerabilities within the PHP code itself.
A web application firewall (WAF) may block specific malicious traffic patterns. However, its effectiveness depends on having rules capable of detecting the exploitation attempt.
Furthermore, the newly discovered vulnerabilities affect internal PHP mechanisms and may be exploitable through different execution paths.
For this reason, installing the patched PHP versions remains the most important security measure.
Perimeter protection, network segmentation, privilege restrictions and monitoring should be viewed as additional layers within a broader cybersecurity strategy.
The Importance of Preventive IT Maintenance for Business Security
One of the main lessons from this incident is that IT security is not simply about installing antivirus software or protecting network access.
Organizations must also understand the technologies supporting their business applications and ensure those components remain updated.
In companies with multiple servers, vendors and applications, this responsibility may be shared across several teams.
For example, a hosting provider may be responsible for maintaining the operating system, while a separate software vendor or internal IT department manages the application itself.
When these responsibilities are not clearly defined, critical updates can be overlooked because no single team has full visibility of the environment.
At Inmove IT Solutions, we help businesses manage their technology infrastructure through IT systems administration services, maintenance and monitoring.
Our approach focuses on preventing incidents, monitoring system health and supporting business service continuity.
Frequently Asked Questions About Critical PHP Vulnerabilities
These are some of the most common questions business owners and IT managers may have following the publication of these security alerts.
Are All Websites Using PHP Vulnerable?
Not necessarily. This depends on the installed version, the security patches applied and the environment configuration. However, installations running affected versions without the appropriate patches should be considered at risk, particularly if they are accessible from the Internet.
Does Updating WordPress Protect Against These Vulnerabilities?
Not by itself. WordPress and PHP are separate components. Even if WordPress, its themes and plugins are fully updated, it is essential to verify that the server is running a patched PHP version.
How Can I Find Out Which PHP Version My Company Uses?
The PHP version can be checked through hosting administration tools, directly on the server or with commands such as php -v. However, distributions that backport security patches also require verification of the installed package security status.
Are Older PHP Versions Still Secure?
Versions that have reached their official end-of-support date no longer receive security fixes from the PHP project. Some providers offer extended support, but it is essential to confirm that recent vulnerabilities have been addressed. Continuing to run unsupported software without security maintenance increases risk.
Should an Application Be Shut Down If It Cannot Be Updated Immediately?
This depends on its exposure and the associated risk assessment. Cybersecurity authorities recommend considering temporarily disconnecting vulnerable systems when patches cannot be applied and sufficient safeguards are not available to keep them operating safely.
Can a Docker Container Running PHP Also Be Affected?
Yes. If a container image includes a vulnerable PHP version, the container may remain exposed even if the host operating system is up to date. Organizations must check container images, install patched releases and redeploy affected containers.
Inmove IT Solutions: Protecting and Maintaining Business IT Infrastructure
Vulnerabilities CVE-2026-109618 and CVE-2026-109619 are a reminder that even widely adopted technologies can contain serious security flaws.
The difference between a vulnerability patched in time and a major security incident may depend on an organization’s ability to identify its assets, manage updates and respond quickly.
At Inmove IT Solutions, we provide IT maintenance and systems management services for businesses that need to keep their technology infrastructure secure and operational.
Do you know whether your servers and applications are running affected PHP versions? We can help you review your infrastructure, assess the risks and plan the necessary updates while taking your business continuity requirements into account.
Discover our business IT maintenance and support services.
Need specialized IT assistance? Contact us and we will assess your company’s technology requirements.
