Critical PHP Vulnerabilities: What Website Owners Need to Know

This is utterly shocking: 70% of websites could be running out-of-date software, putting them at risk. Over the last few hours, an AI-made discovery has shaken the very foundations of the web for many websites.

Two critical vulnerabilities in PHP have been disclosed, prompting urgent security updates for servers running PHP. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have a CVSS v4.0 severity score of 9.2 out of 10.

PHP is one of the most widely used technologies on the web, powering content-management systems and applications such as WordPress, Drupal and Joomla.

The vulnerabilities affect PHP’s core request-handling and memory-management processes. Under certain conditions, an unauthenticated attacker could execute code on a vulnerable server.

Which PHP versions are fixed?

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Linux distributions may use different-looking version numbers because they often backport security fixes into existing packages. For example, Ubuntu 24.04’s patched PHP 8.3 package is listed as:

8.3.6-0ubuntu0.24.04.13

This means that checking only the visible PHP version, such as PHP 8.3.6, may not be enough. The full operating-system package version must also be checked.

What should website owners do?

1. Update PHP through your hosting provider or operating system package manager.
2. Check the PHP runtime used by the web server, not only the command-line version - really important.
3. Check PHP installations running in containers, control panels or separate hosting accounts.
4. Upgrade unsupported PHP versions or ensure they receive trusted security backports.
5. Review server logs for unusual activity if patching was delayed.

This incident is an important reminder that keeping the operating system, web server, PHP runtime, plugins and applications up to date is an essential part of maintaining a secure website.

For further information, see the official PHP security information and the BBC report.