The news
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says either one can let an attacker run their own code on a web server without logging in. Both are rated 9.2 out of 10, and the project gave a day's notice that a critical release was coming.
PHP is the programming language behind WordPress, WooCommerce, Laravel and many other website systems. The PHP security team says every PHP installation that serves web pages is at risk. The risk is highest on servers that run PHP inside Apache as mod_php, where the team has shown that a single request can start the attack before the website's own code runs. PHP says only an update fully fixes the problem, and that changes to settings just reduce the risk.
PHP 8.1 and older no longer get official updates. Some Linux vendors provide patched packages for them, and the PHP team has published basic fixes for versions 7.4, 8.0 and 8.1 for those who build PHP themselves. CERT-EU, the cyber security service of the EU institutions, said on 23 October that early attack code is circulating, which raises the chance that the flaws are already being used.
Update, 27 October: the flaws are now used in real attacks. A security researcher caught a successful attack on a trap server running PHP 8.4.26 inside Apache as mod_php, and on 26 October CISA, the US cyber security agency, added both flaws to its list of vulnerabilities known to be exploited.
On 23 October, PHP also described a third, less likely issue that only affects unusual setups and will be fixed in the next regular release. PHP 8.2 stops receiving security fixes after 31 December 2026.
What it means for you
- If your website or online shop runs on WordPress, WooCommerce, Laravel or another PHP system, the server needs the new PHP version. Updating plugins or the theme does not fix this.
- On shared or managed hosting, the host usually updates PHP. On your own server or a rented virtual server, someone on your side has to do it.
- Sites still on PHP 8.1 or older get no official fix, and PHP 8.2 loses security fixes after 31 December 2026.
What to do now
- Ask your host or developer which PHP version each of your sites runs, and whether it is now on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on a patched package from the server's vendor.
- Include every PHP system you use, such as a customer portal, a booking system or an internal tool, not only the main website.
- If anything runs on PHP 8.1 or older, plan the move to a supported version now.
- After the update, test your contact forms, checkout and logins.
How Didset can help
We build and look after web apps and integrations, and we can update the PHP version under your site and check that forms, checkout and logins still work.
Talk to us about it
