PHP fixes two critical flaws that can let attackers take over websites

PHP, the programming language that runs a large share of websites, has released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. According to the PHP security team, both can allow unauthenticated remote code execution: an attacker could run their own code on a web server without logging in. PHP rates both 9.2 on the CVSS v4.0 scale.

The Australian Signals Directorate’s Australian Cyber Security Centre has also published an alert, Critical vulnerabilities in PHP.

Who it affects

Websites and web applications running PHP. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers mod_php the highest risk. Many content management systems, online shops and hosting plans use PHP behind the scenes, so it may affect a business website even if nobody there works with PHP directly.

What PHP says to do

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP says “there are no complete mitigations, updating is the only safe choice.”
• PHP says Linux distributions and long-term support vendors received the patches in advance, and to check with your vendor for updated packages. On shared or managed hosting, that’s usually the hosting provider, which shows the PHP version in its control panel.
• PHP 8.1 and older no longer get updates from the PHP project. PHP points users of these versions to their vendor for backported fixes, or to an upgrade to a supported version.
• PHP notes that 8.2 reaches end of life on 31 December 2026.

Our supplier and IT provider security guide covers the questions official guidance suggests asking website and hosting providers.