Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What to Do Now

What happened

On October 21, 2026 the PHP project published two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution: an attacker can send a crafted web request and run commands on the server, without a password. That can mean a defaced or hijacked website, stolen customer data, malware served to your visitors, or the server being used to attack others.

PHP runs a large share of the web, so these flaws are being treated as urgent across the industry. Security researchers have reported that proof-of-concept exploit code is already public, which means automated attacks usually follow within days.

Who is affected

Any system where PHP answers web requests is potentially affected until it is updated. In practice, look at:

• Websites built on PHP: most popular content management systems, online stores and custom-built sites.
• Admin and booking portals your team or your clients log in to, if they are written in PHP.
• Network devices such as routers, firewalls and storage boxes whose web admin pages use PHP. These need a firmware update from the manufacturer.
• Old or forgotten installs: a staging copy, a test site or a legacy app that still answers on the internet.

The flaws are reported to reach back to PHP 5. Fixed releases exist only for the supported branches:

Am I affected? A quick check

1. Does your website run on PHP? If you are not sure, ask your web developer or hosting company. Most small business websites do.
2. Who updates it? On managed hosting the provider usually updates PHP for you. On your own server or a virtual private server, someone on your side has to do it.
3. Which PHP version is it on? Your hosting control panel shows it, usually under "PHP version" or "PHP settings". Compare it with the table above.
4. Any other web admin pages? List your router, firewall, storage and phone system admin pages and check the manufacturer's security notices for a firmware update.

What to do now

1. Make an inventory. Every website, portal and device that runs PHP, including ones you do not think of as "PHP servers".
2. Update PHP today to the patched version for its branch. If your site runs on a content management system or framework, also apply any updates its developers release for this issue.
3. Upgrade end-of-life versions. PHP 8.1 and older will not be patched. Move to 8.2 or newer, test your site, then apply the patch.
4. Back up before you change anything, and confirm the backup restores.
5. Check for signs of compromise after patching: unfamiliar admin accounts, new files in upload folders, changed pages, or unusual outbound traffic. Patching closes the door but does not remove an intruder who is already inside.

If you cannot update today

The PHP project has published temporary measures that reduce exposure to specific attack paths. They do not make an unpatched server safe, so treat them as a bridge of hours or days, not a fix:

• Restrict public access to any PHP application that does not need to be on the internet (admin panels, staging copies, test sites).
• Put a web application firewall in front of public PHP sites and block entry points that are not needed, such as remote publishing interfaces that your site does not use.
• Turn on monitoring and alerts for new files, new admin users and unusual traffic.
• Book the update for the earliest possible window and follow it through.

How Hexafusion can help

If you are not sure whether your website, portal or network devices run PHP, or who is responsible for updating them, we can check for you. We identify every internet-facing system, confirm the PHP version, coordinate the update with your web developer or hosting company, and look for signs of compromise afterwards.

Sources: the PHP project's security advisory and release notes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the public CVE records for CVE-2026-109618 and CVE-2026-109619. This article is general information, not a substitute for advice on your specific systems.