PHP users have a serious security problem. The PHP Foundation revealed two critical vulnerabilities that could affect millions of websites, including WordPress sites hosted on servers using PHP. The flaws carry a CVSS severity score of 9.2 out of 10 — a number that leaves little room for creative interpretation.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They could allow unauthenticated remote code execution, giving attackers a way to run malicious code or read sensitive memory without first logging in.
An attacker can exploit the flaws through a file upload interface. From there, the vulnerabilities could enable attackers to alter websites, steal data, or execute code on affected systems. Security experts also warn that the flaws could support wormable malware, allowing attacks to spread across large parts of the internet.
The vulnerabilities affect PHP installations serving web requests from PHP version 5 onward. PHP 5 was released in July 2004, placing the affected software across more than two decades of deployments and making this less a narrow software bug than a long-running infrastructure problem.
The PHP Foundation announced the vulnerabilities on October 20, 2026. Security patches arrived at 10 am ET on October 21, 2026, but only PHP 8.2 and newer versions receive support and patches from PHP. Some PHP distributions and third-party vendors still produce legacy fixes, yet those options depend on the provider.
There is no complete workaround. “There are no complete mitigations, updating is the only safe choice,” the PHP Foundation said. Gina Peter Banyard, a PHP developer, delivered the less comfortable version of the same advice: “Patching is the only mitigation, and otherwise turning servers off might be the most sensible thing to do.”
The patch window is already under pressure
Early attacks appeared before the vulnerabilities were publicly detailed and fixed. Cloudflare CTO Dane Knecht said, “We are seeing early attacks emerging,” while Sansec warned, “We expect mass attacks to start within 15 minutes of the release.” That timetable turns routine maintenance into a race against systems that may already be probing exposed upload interfaces.
Some organizations took their websites offline as a precaution. GrapheneOS temporarily took its forum offline, while the European Union Computer Emergency Response Team and the UK National Cyber Security Centre advised organizations to patch or isolate affected systems.
Security firms estimate that 1.3 million internet-connected hosts are likely affected. The number does not describe every vulnerable website, but it shows the scale of the exposure once attackers begin scanning for unpatched PHP installations.
Why WordPress operators should pay attention
WordPress powers more than 40 percent of the internet, and WordPress sites are vulnerable because they run on servers that use PHP. The content management system is not identified as the source of the flaws, but a vulnerable PHP server beneath a WordPress site can still expose the site to malicious code, altered pages, and stolen data.
Website owners need to identify the PHP version running their servers and move to PHP 8.2 or newer where possible. Organizations that cannot patch should follow the advice to isolate or shut down affected servers, because the PHP Foundation says no complete mitigation exists.
The timeline is blunt: public disclosure came on October 20, patches arrived on October 21 at 10 am ET, and early attacks were already visible. For systems still running PHP versions from PHP 5 through unsupported releases, leaving the door open is now a security decision — not an oversight.
Based on
- ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire — wired.com
- What to know about critical online vulnerability threatening many websites | The Independent — independent.co.uk
- PHP warns it plans to release 2 emergency patches imminently – Ars Technica — arstechnica.com
- A critical PHP vulnerability may take websites down today | The Verge — theverge.com
