On 21 October 2026, the PHP project released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. CERT-EU warns that public technical details and early proof-of-concept code increase the chance of attacks. If your business website or application runs PHP, treat this as an urgent maintenance item.
Which PHP versions are affected?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as appropriate for your supported branch. Earlier releases in those branches are affected. PHP 8.1 and older are end-of-life; check with your operating system or hosting vendor for a supported, patched package, or plan an upgrade. PHP may also be bundled inside other software, so check vendor advisories for products that include PHP.
What should you do now?
- Inventory PHP versions across production servers, staging environments, containers and managed hosting accounts.
- Apply the fixed release from your distribution or hosting vendor, then restart PHP workers and relevant services.
- Verify the running version and confirm the application still works, including uploads, imports, sessions and background jobs.
- If you cannot patch promptly, restrict public access to affected internet-facing services until the update is applied and verified.
Temporary configuration changes may reduce exposure to specific attack paths, but CERT-EU says only an update fully fixes these vulnerabilities. Treat mitigations as a short bridge while arranging the patch, and follow the advice from your PHP, operating system and hosting vendors.
Why this matters to business owners
These flaws affect PHP request handling, so risk is not limited to a particular plugin or application feature. A vulnerable PHP runtime exposed to web requests may be at risk even before application code runs. Ask your web host or technical team to confirm the PHP version, patch status and restart completion in writing.
Source: CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP, released 21 October 2026. This post is an operational summary; consult the advisory and your vendors for technical instructions.
