Brief

PHP team releases emergency patches for critical code‑execution flaws

The PHP security team issued emergency patches for two high‑severity flaws on Oct. 21, 2026, and warned that all installations are at risk.

By Felo News Desk · Published Thu, 22 Oct 2026 05:04:22 GMT

The PHP security team announced emergency fixes on October 21, 2026, for two critical vulnerabilities that allow attackers to execute code on website servers without logging in, according to Search Engine Journal.

What happened

The patches address flaws in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says the only safe remedy is to upgrade to one of these fixed versions; no workaround fully mitigates the risk. All installations that serve website requests are considered vulnerable, with Apache servers using mod_php facing the highest exposure because the attack can run before the site’s own code starts.

What the reports add

Search Engine Journal notes that older PHP releases—8.1 and earlier—remain on the end‑of‑life list and will not receive regular updates. For this emergency, limited source‑code fixes are provided for PHP 7.4, 8.0 and 8.1 for teams that compile PHP themselves, though these do not restore ongoing support. Hosting providers and long‑term‑support vendors may also supply their own updates.

What was said

PHP’s statement, as quoted by Search Engine Journal, emphasizes that “updating is the only safe choice because no workaround fully addresses the vulnerabilities.” The article also reports that “Ask your host to install the fix” and advises site owners to confirm that any version selected via cPanel includes the patch.

How it came about

Earlier on October 21, Felo News reported on the imminent PHP patches, describing the two 9.2‑severity vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) and noting that the flaws affect every PHP version from 5 onward. The NSA warning and the PHP maintainers’ advisory highlighted the rapid discovery of the bugs by AI tools, prompting the emergency release.

Key facts

PHP released emergency patches for two critical code‑execution flaws on Oct. 21, 2026. (searchenginejournal.com)
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. (searchenginejournal.com)
All installations serving website requests are at risk, with Apache mod_php most exposed. (searchenginejournal.com)
Older PHP versions (8.1 and earlier) remain end‑of‑life and receive no regular updates. (searchenginejournal.com)
Limited source‑code fixes are provided for PHP 7.4, 8.0 and 8.1 for self‑compiled builds. (searchenginejournal.com)