Picture the website your business launched a few years ago. A web designer built it, a hosting company keeps it online, and nobody on your team has thought about the software underneath it since.
Then, on a Wednesday, the people who maintain that software announce two critical flaws and tell everyone to update.
That is what the PHP project did on October 21, 2026.
What Happened
PHP is the programming language behind a large share of the web. WordPress is written in it, and so are many custom business sites, customer portals, and web applications.
On October 20, the PHP project announced a security release for two critical vulnerabilities. On October 21 it published the fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
According to the project's advisories, the two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on the CVSS v4.0 scale, which the advisories classify as critical. The advisories say both can allow unauthenticated remote code execution, meaning an attacker who is not logged in could run code on the server with the privileges of the web process.
In plain terms, the first flaw involves how PHP handles running out of memory in the middle of a request. The second involves leftover data from one request being reused by a later one. The advisories list PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed setups as affected, and describe the risk as highest on Apache with mod_php. How reliably the flaws can be exploited depends on the specific build, extensions and server setup.
The PHP project says updating is the only complete fix. It lists some settings that reduce exposure, but says they do not make an installation safe.
The project also notes that PHP 8.1 and older no longer receive updates from the PHP project. Some Linux distributions and long-term support vendors provide their own backported fixes. PHP 8.2 reaches end of life on December 31, 2026.
On October 22, government agencies, including New Zealand's National Cyber Security Centre, said they were aware of reports of active exploitation. Treat the situation as urgent, without assuming any particular site has been hit.
The Question Most Owners Cannot Answer
When a flaw like this is announced, the first useful question is who updates the software on your site.
Some hosting providers update PHP for their customers. Others leave it to the customer or the web developer. On a server someone set up years ago, the answer can be nobody.
That is what makes forgotten websites the weak point: an old marketing site, a landing page from a past campaign, a client portal that still works so nobody touches it. They keep running, and they keep running whatever PHP version they started with.
Do you know which version of PHP each of your websites is running?
Talk to Our TeamWhat To Actually Do About It
What to do this week
You cannot fix a flaw in software you did not write. You can find out, today, whether the people responsible for it have.
Patch Management topic cluster: related reading
Managed IT Services | Los Angeles, CA
IT Accuracy provides cybersecurity and security awareness training, managed network services, patch management, and help desk support for businesses across Los Angeles and nationwide.
