Two critical security vulnerabilities affecting PHP, the programming language behind millions of websites and online applications, have prompted urgent warnings from cybersecurity agencies and software developers worldwide. The flaws could allow attackers to take control of vulnerable web servers without a password or other authentication, potentially exposing sensitive information and disrupting online services.
The PHP development team released emergency security updates Wednesday, October 21, after identifying the vulnerabilities, officially tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a critical severity rating of 9.2 out of 10. The National Security Agency has urged organizations to identify affected systems and install the available fixes immediately.
The security threat extends across a wide range of websites because PHP is used by popular content management systems, including WordPress. The vulnerabilities exist within PHP itself rather than WordPress software, meaning website owners cannot resolve the problem simply by updating their WordPress installations, themes or plugins. Hosting providers may need to update the PHP software running on their servers.
The flaws, collectively known as PHP2Shell, involve weaknesses in how PHP manages computer memory and processes web requests. Successful exploitation could allow an unauthorized attacker to execute malicious instructions on an affected server. Cybersecurity authorities have warned that businesses and government agencies should prioritize publicly accessible systems, particularly those handling sensitive information.
Website owners are being advised to check their PHP versions and coordinate with hosting providers to ensure the security updates have been installed. The fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations unable to apply the updates immediately may need to temporarily isolate vulnerable systems until they can be secured. Officials emphasize that installing the patched software is the only complete solution to the newly disclosed vulnerabilities.
