PHP fixes two critical vulnerabilities in every supported version
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that let an attacker run code on a web server without logging in. PHP 8.1 and older get no fix.
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can let an attacker run their own code on a web server without logging in. Both are rated 9.2 out of 10 (CVSS 4.0). The PHP project asks every user to update immediately.
Who is affected
Every PHP installation that serves web pages: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php carries the highest risk. The PHP project has seen a working attack there in which a single request is enough, before any of the site's own code runs.
WordPress, Joomla, Drupal and Magento all run on PHP, so a site built with any of them is affected until the PHP underneath it is updated. The same goes for a site written by hand in PHP.
Which versions get a fix
| PHP version | Fixed in | Security fixes until |
|---|---|---|
| 8.5 | 8.5.12 | 31 December 2029 |
| 8.4 | 8.4.27 | 31 December 2028 |
| 8.3 | 8.3.36 | 31 December 2027 |
| 8.2 | 8.2.35 | 31 December 2026 |
| 8.1 and older | No release | Ended |
PHP 8.1 and older no longer get releases. For 7.4, 8.0 and 8.1 the PHP project published only minimal source patches, which a hosting company or a Linux distribution may or may not apply. PHP 8.2 itself reaches its end of life on 31 December 2026 and gets no security fixes after that, so a site on 8.2 should plan its move to 8.3 or later now.
What to do
Updating PHP is the only real fix. The settings the PHP project lists as mitigations reduce the risk, but in its own words they do not make an installation safe.
- Find out which PHP version your site runs. It is usually shown in the hosting control panel, under a name like "PHP version". Your developer or hosting company can also tell you.
- If it is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, switch to one of these or later, or ask the hosting company when it will. If you run your own server, update the PHP package from your distribution or from php.net.
- If the site only works on PHP 8.1 or older, its code has to be updated before it can move to a supported version. This is the moment to plan it.
- After the update, check what matters most: the home page, the forms, the shopping cart and the admin login.
How we can help
Our own websites are static files and run no PHP, so this does not affect them. If you are not sure where your site stands, ask us for a free review. We look only at what anyone can see from outside, such as the software versions a site reveals, and send you a written report within three working days. If the site needs more than an update, we can move it to a supported version or rebuild it as a fast static site, with Python only where something has to run.
Sources: php.net news, 21 October 2026 and PHP supported versions.