PHP Security Vulnerability 2026: Risks, Affected Websites and Fixes
PHP powers millions of websites, online stores, and business applications. However, security flaws in the PHP runtime can put these websites at risk, even when their application code is well maintained. In October 2026, the PHP development team disclosed two critical remote code execution vulnerabilities and published security updates for affected PHP branches.
A further informational advisory followed on October 23 concerning another potential remote code execution issue. Businesses should understand which versions need updating, what the risks are, and how to protect their websites without relying on temporary workarounds alone.
Table of Contents
What Is the PHP Security Vulnerability in 2026?
Which PHP Versions Are Affected?
What Risks Do These Vulnerabilities Create?
How Businesses Can Protect Their Websites
What If PHP Cannot Be Updated Immediately?
What Is the PHP Security Vulnerability in 2026?
On October 21, 2026, the PHP team announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can potentially allow unauthenticated remote code execution, meaning an attacker may be able to trigger code execution on a vulnerable server without first logging in.
The first vulnerability involves an out-of-memory handling problem that can leave internal request data partially initialised. The second involves stale internal state that may remain referenced after its underlying memory has been released. These are runtime-level issues, so updating website plugins or changing application code alone will not necessarily resolve them.
On October 23, the PHP team also published an informational advisory about CVE-2026-115560, involving an unusual combination of session serialization settings and application behaviour. The team recommended disabling session upload progress until a regular bug-fix release addresses the issue.
Businesses can review the official PHP security announcements for technical details and subsequent updates.
Which PHP Versions Are Affected?
The October 21 security release provided fixes for four PHP branches. Administrators should verify their installed package versions and check whether their hosting provider has applied the appropriate patches.
| PHP branch | Security release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
These releases address CVE-2026-109618 and CVE-2026-109619. The October 23 advisory for CVE-2026-115560 should be assessed separately because the PHP team had not yet published its full security advisory in the October 23 announcement.
The PHP team identified web-facing installations as being at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The advisory highlighted particular concern for Apache configurations using mod_php.
PHP 8.2 is scheduled to reach the end of its security-support period on December 31, 2026. Organisations using it should plan an upgrade to a supported branch. Check the official PHP support schedule before deciding on an upgrade path.
What Risks Do These Vulnerabilities Create?
The consequences depend on the vulnerable runtime, server configuration, and permissions available to the affected process. Potential risks include the following.
1. Unauthorised server access
Remote code execution may allow an attacker to run unauthorised code through a vulnerable service. Depending on the server's permissions, the impact could extend beyond one website.
2. Exposure of customer information
Websites often store customer details, account records, order information, and other sensitive data. A server compromise may expose information that businesses are responsible for protecting.
3. Website changes and malicious redirects
An attacker who gains sufficient access may attempt to change website files, create unauthorised accounts, inject malicious content, or redirect visitors to harmful websites.
4. Downtime and recovery costs
Investigating a security incident, restoring clean files, checking databases, and rebuilding affected systems can interrupt normal operations. Online businesses may also lose sales while their websites are unavailable.
5. Damage to search visibility and customer trust
If a compromised website distributes malware or redirects visitors, browsers and search engines may warn users. Resolving the security issue is essential, but restoring customer confidence can take longer.
These are potential consequences, not proof that every website running an affected PHP version has been compromised.
Which Websites and Businesses Are at Risk?
Any organisation using PHP to serve web requests should check its runtime and patch status. The level of exposure depends on the specific configuration and whether the relevant security fixes have been applied.
- WordPress websites: The PHP runtime, WordPress core, themes, and plugins all need appropriate maintenance.
- Laravel applications: Business portals, APIs, customer dashboards, and other PHP applications require compatible, patched runtimes.
- E-commerce stores: Online shops may process customer details, orders, and other business-sensitive information.
- Membership and booking websites: These platforms often handle accounts, subscriptions, bookings, and personal information.
- Shared hosting providers: A single server may host multiple websites, making runtime maintenance important for the provider and its customers.
Smaller websites should not assume they are safe simply because they receive less traffic. An outdated runtime or delayed security update can create avoidable exposure regardless of the size of the business.
How Businesses Can Protect Their Websites
1. Install the appropriate PHP security updates
Check the PHP version used by the actual web server, not only the command-line version shown by php -v. A server may have different PHP installations for command-line tasks and web requests.
Upgrade to the appropriate fixed release or install the security-patched package supplied by your operating-system vendor. Test compatibility where practical, then deploy the update promptly. Check the separate October 23 advisory for CVE-2026-115560 rather than assuming the October 21 releases address every issue.
2. Confirm patch status with your hosting provider
If you use shared or managed hosting, ask the provider whether the October 21 security fixes have been applied and how it is handling the October 23 advisory. Request confirmation of the installed package or backported security patch.
3. Keep frameworks and dependencies updated
Update application frameworks, plugins, themes, and third-party libraries. Remove components that are no longer needed and investigate dependencies that no longer receive security fixes. Application maintenance is important, but it does not replace runtime patching.
4. Restrict server permissions
Run PHP processes with only the permissions they require. Keep database credentials and application secrets outside publicly accessible directories, and prevent writable upload folders from executing arbitrary scripts where possible.
5. Strengthen administrator access
Use unique passwords and multifactor authentication for hosting dashboards, SSH accounts, source-code repositories, and administrator panels. Remove unused accounts and limit access to authorised staff.
6. Monitor logs and unusual activity
Review web-server logs, PHP-FPM logs, authentication records, and security alerts. Investigate unfamiliar administrator accounts, unexpected file changes, unusual processes, and suspicious outbound connections.
Security monitoring can help identify suspicious behaviour, but a web application firewall is not a substitute for applying the official PHP security fixes.
Businesses should also understand the warning signs of compromised devices. Our guide explains how to recognise signs that a phone has been hacked and take steps to secure affected accounts.
Network protection is another part of a broader security strategy. Read these practical ways to secure a Wi-Fi network to learn about router security, passwords, and connected devices.
7. Maintain tested backups
Keep regular backups of website files, databases, and critical configuration. Store backups separately from the production environment and test restoration procedures periodically. If an incident occurs, a clean and tested backup can reduce recovery time.
What If PHP Cannot Be Updated Immediately?
Temporary mitigations should not be treated as a complete solution. The PHP team explicitly stated that the October 21 critical vulnerabilities have no complete mitigations and that updating is the only safe choice.
For CVE-2026-115560, the October 23 informational advisory recommends setting session.upload_progress.enabled=0 until a regular bug-fix release addresses the issue. The advisory explains that the issue requires an unusual combination of session serialization settings and application behaviour.
Administrators should apply this setting at an appropriate server configuration level, such as PHP-FPM pool or server configuration, where it takes effect before request processing. Follow the official advisory for the correct deployment and restart requirements.
Do not assume that disabling session upload progress resolves the two October 21 vulnerabilities. Their temporary mitigations are configuration-specific and incomplete, and the official PHP team advises upgrading. If a prompt update is not possible, contact the hosting provider or a qualified security professional to assess the exposure and arrange a safe upgrade.
Frequently Asked Questions
What is the PHP security vulnerability in 2026?
The October 21 announcement covered two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. A separate informational advisory for CVE-2026-115560 followed on October 23.
Can a PHP vulnerability affect a WordPress website?
Yes. WordPress uses PHP, so its server runtime is part of the website's security boundary. Website owners should confirm the runtime's patch status and keep WordPress core, themes, and plugins updated.
How can I check my website's PHP version?
Check the version configured in your hosting control panel or ask your hosting provider. The command php -v shows the command-line version, which may differ from the PHP version serving website requests.
Is updating PHP enough to secure a website?
Updating addresses the relevant runtime vulnerabilities, but businesses must also maintain application dependencies, restrict permissions, protect administrator accounts, monitor activity, and keep tested backups.
What should a business do first?
Identify all web-facing PHP installations, verify their patch status, and prioritise the appropriate security updates. Ask the hosting provider to confirm the fixes if you do not manage the server yourself.
Final Thoughts
The PHP security vulnerabilities disclosed in October 2026 highlight why regular server maintenance matters. Even a well-built website can face risk if its underlying runtime is not maintained.
Businesses should verify their PHP versions, install the appropriate security fixes, review server permissions, and monitor for signs of compromise. They should also assess the separate October 23 advisory and avoid treating temporary mitigations as a replacement for official updates.
A consistent patching schedule, secure access controls, and tested backups can help protect customer information and keep business websites dependable.
