On Wednesday, October 21, 2026, web administration teams around the world rushed to apply emergency security updates after developers discovered severe PHP vulnerabilities that allow attackers to gain remote control of victim systems.
Key takeaways
- The PHP Foundation released emergency updates to fix two critical security flaws.
- The issues affect all PHP installations serving web requests going back to PHP version 5.
- Only PHP 8.2 and newer receive official patches from the foundation.
- Cloudflare reported seeing early attacks emerging before fixes were detailed.
What are the critical PHP vulnerabilities affecting the web?
Wired reports that the PHP Foundation detailed two critical flaws, tracked as CVE-2026-109619 and CVE-2026-109618. These security gaps impact all installations serving web requests dating back to PHP 5, which launched in July 2004. Independent security consultant Lukasz Olejnik described the situation by stating, according to Wired, that it is not a drill. Since its creation in the 1990s, the scripting language has powered vast portions of the internet.
Platforms like WordPress, Drupal, and Adobe’s Magento rely on the language, turning it into critical infrastructure. Davi Ottenheimer explained, according to Wired, that the bug lives inside a file upload interface and functions like a front door with no lock. Attackers can send a crafted upload to any server without needing to know specific software details.
Why security updates are the only safe choice
The PHP Foundation noted that only PHP 8.2 and newer versions remain supported for official patches, though some legacy vendors offer independent fixes. Because foundational web layers often persist un-updated in historic infrastructure, experts warn that updating remains mandatory. According to Wired, the advisory states there are no complete mitigations available.
What happens next?
Millions of systems face potential risks if attackers exploit these deployments rapidly. Security firm Sansec warned that mass attacks could start within 15 minutes of the release, while Cloudflare observed early attacks emerging even before the fixes went live just before 10 am ET on Wednesday. Teams must patch immediately to prevent wormable malware from hitting large portions of the web.
Frequently asked questions
The PHP Foundation detailed two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, which affect all installations serving web requests going back to PHP version 5 from July 2004.
Only PHP 8.2 and newer are still officially supported and will receive security patches from the PHP Foundation, though some legacy vendors produce third-party fixes.
The bugs reside in a file upload interface that acts like an unlocked front door, allowing attackers to send a single crafted upload to any server and potentially gain remote control.
No, according to advisories from the PHP Foundation, there are no complete mitigations, and updating is the only safe choice for web administrators.
The PHP Foundation released the emergency security updates just before 10 am ET on Wednesday, following early attack observations by Cloudflare.
Based on reporting by Wired. Read the original article
