Critical PHP vulnerabilities: What is it, how it can affect websites & what should users know?

Two critical security vulnerabilities in PHP, a programming language that powers millions of websites and web applications, have triggered urgent warnings from cybersecurity agencies, with experts advising organisations to install security updates immediately.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on vulnerable servers without logging in or obtaining prior authentication. Both vulnerabilities have received a critical severity score of 9.2 on the Common Vulnerability Scoring System (CVSS) version 4.0. The PHP development team released security fixes on October 21, 2026.

The vulnerabilities are particularly concerning because they affect PHP's core runtime rather than a single website, plugin or application. Consequently, websites and services using vulnerable PHP versions could face risks even if their application code has no direct security flaw. India's Computer Emergency Response Team (CERT-In) has also issued a critical vulnerability note urging affected users and organisations to apply the relevant security updates.

What is PHP and why is it important? 

PHP is an open-source, server-side scripting language widely used to build dynamic websites and web applications. It helps websites process user requests, communicate with databases, manage logins and display content that changes according to user activity.

PHP supports widely used platforms and content management systems, including WordPress, Drupal and Joomla. It can also operate through different server configurations, including PHP-FPM, Apache's mod_php module, php-cgi and LiteSpeed.

Because PHP runs on the server, a serious vulnerability in its underlying engine can put more than a website's displayed content at risk. If attackers gain the ability to execute code on the server, they may be able to compromise applications, access sensitive information or disrupt services, depending on the system's configuration and the privileges available to the compromised process.

What are the two critical PHP vulnerabilities? 

The two flaws, collectively associated with the name "php2shell", concern how PHP handles memory and internal program state while processing requests.

1. CVE-2026-109618 (Out-of-memory corruption): This vulnerability involves PHP's handling of situations in which the system runs out of memory while processing a request. Under certain circumstances, PHP can interrupt request processing before its internal data has been fully initialised. During subsequent cleanup, the software may mistakenly treat invalid or partially initialised memory as valid. An attacker may be able to exploit this condition to execute malicious code remotely.

In simple terms, the problem arises when PHP encounters a memory shortage and fails to handle the resulting interruption safely.

2. CVE-2026-109619 (Stale global state): The second vulnerability concerns internal data that PHP uses while handling requests. In certain circumstances, PHP may retain a reference to memory that has already been freed. A subsequent request handled by the same worker process may then encounter this outdated internal state before it has been properly reset.

This can cause PHP to access invalid memory and potentially allow an attacker to execute malicious code.

The two vulnerabilities involve different memory-management failures, but their potential consequences are similar: an attacker could gain the ability to run code on an affected server without authentication. Both flaws have been assigned a CVSS 4.0 score of 9.2, placing them in the critical category.

The vulnerabilities affect multiple PHP versions, including older releases. The PHP project has issued fixes for four supported release branches.

PHP 8.1 and older releases are also affected but no longer receive security updates directly from the PHP project. Some operating system vendors and long-term support providers may supply backported fixes.

Organisations should verify the security status of their installed packages with their hosting provider or software vendor rather than relying solely on the version number displayed by a system.

How serious is the threat? 

The biggest concern is that the vulnerabilities could enable remote code execution, or RCE, without requiring an attacker to authenticate first.

Remote code execution allows an attacker to make a vulnerable system run commands or code of their choosing. Depending on the attacker's access and the server's security controls, the consequences could include:

• Website compromise: Attackers could alter website content, redirect visitors or insert malicious scripts. 
• Data theft: Sensitive information accessible to the compromised process, potentially including customer records and credentials, could be exposed. 
• Server takeover: Attackers could attempt to establish persistence, deploy additional malware or use the compromised server to attack other systems. 
• Service disruption: A compromised server could be damaged, misused or rendered unavailable. 

These are potential consequences of successful exploitation, not confirmation that every vulnerable website has been compromised.

The risk extends beyond organisations that knowingly operate PHP-based websites. Third-party software, containers and other products may include PHP components in the background. Organisations should therefore check their broader technology environments.

What should website owners & organisations do? 

The immediate priority is to identify vulnerable PHP installations and apply the relevant security fixes.

• Update PHP immediately: Install the appropriate fixed release, or a security update provided by the relevant operating system or hosting vendor. 
• Check internet-facing systems first: Publicly accessible servers and applications should receive priority, particularly where PHP processes requests from untrusted sources. 
• Check third-party software: Review content management systems, hosting environments, containers and other products that may bundle or depend on PHP. 
• Review security logs: Look for unusual processes, unexpected files, suspicious outbound connections and abnormal web-server or application activity. Patching alone does not establish whether a system was previously compromised. 
• Isolate systems if necessary: If a vulnerable internet-facing system cannot be patched promptly, organisations should assess whether it needs to be temporarily isolated from public networks until remediation is possible. 

Security agencies have stressed that updating to a fixed release is the complete remediation. Organisations should not assume that a web application firewall or another temporary defensive measure is an adequate substitute for patching.

How the world acted to contain the threat 

Websites taken offline in Europe: The European Commission, the European Union Agency for Cybersecurity (ENISA), CERT-EU and Europol's European Cybercrime Centre issued a joint warning urging organisations to address the vulnerabilities immediately.

In the Netherlands, public-facing government and other institutional websites were taken offline as a precaution. Finland's state IT services provider suspended some public network services, while France's Interior Ministry placed its websites under preventive maintenance.

Security agencies urge immediate patching in United States: The US National Security Agency (NSA) warned that PHP's widespread use could create opportunities for malicious cyber actors. Security researchers also reported attempts to exploit the vulnerabilities before and around public disclosure. The US response has focused on identifying potentially vulnerable systems, applying security fixes and detecting attempted intrusions.

CERT-In issues a critical alert in India: India's Computer Emergency Response Team (CERT-In) published vulnerability note CIVN-2026-0510 on October 21, classifying the issue as critical. The agency warned that successful exploitation could allow remote code execution and compromise affected systems. It advised organisations and individuals using vulnerable PHP versions to install the relevant security updates.

Website owners urged to check their systems in Japan: Japanese Prime Minister Sanae Takaichi called attention to the security issue in a post on X, urging website owners to check whether their live sites use PHP and prepare to apply the fix.

Technology companies set up defences & threat monitoring: Cloudflare announced protective measures through its web application firewall, while Google Cloud published guidance on responding to the vulnerabilities. Cybersecurity firms including Wiz, Qualys and Palo Alto Networks also released technical assessments and mitigation advice. The priority is to help organisations identify exposed systems, block malicious traffic where possible and deploy the official patches.

Major online services undertake precautionary shutdowns: Reuters reported that Wikipedia and the Internet Archive temporarily took some systems offline while addressing the security issue.