Two critical PHP flaws hit the foundation of many websites
The PHP project released emergency updates on 21 October; systems on older versions are left without a fix.
On 21 October the PHP project closed two flaws through which attackers can run their own code on web servers without logging in, both rated critical at 9.2 out of 10. The US cybersecurity agency CISA urged immediate updates, and security firms report first attack attempts.
What happened
PHP is the programming language behind a large part of the web: content management systems, online shops, customer portals, many of them run by mid-sized firms and small hosting providers. The flaws sit in the core of the runtime, not in a particular application. According to Google Cloud, all versions from 5.4 to 8.5.11 are affected. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For 8.1 and older the project no longer ships regular updates, only limited source-code fixes for 7.4 to 8.1. The project announced the release a day in advance; Linux distributions received the fixes beforehand. Up to 21 October, Rapid7 had observed no successful exploitation but several reports of attempts. Publicly circulating attack code reportedly works only with certain combinations of operating system, PHP version and web server. Assessment: whether bank systems are affected is not publicly known. The greater risk for users lies with the many smaller websites: a hijacked shop can skim payment data or serve as a backdrop for phishing aimed at banking logins.
What follows
For companies, this is first a question of visibility. It is often unclear which PHP version a website, shop or old partner portal runs on, especially when agencies or hosting providers operate it. The updates exist; the bottleneck is the time until they are installed. The legacy burden weighs more: systems on PHP 8.1 or older often cannot simply be updated because the application must be adapted. Support for PHP 8.2 also ends on 31 December 2026. According to the PHP project, temporary configuration changes reduce the risk only partly. For private users the familiar rule applies: bank only via the official app or an address typed in yourself, and never enter credentials via links in emails or on suspicious pages.
What to watch
- Whether CISA adds the flaws to its catalogue of known exploited vulnerabilities
- Warnings from Germany's BSI and reports of compromised shops in the German-speaking region
- How quickly hosting providers and Linux distributions roll out updated packages
Sources
- PHP-Projekt: Sicherheitshinweis und Releases vom 21. Oktober 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- Rapid7: CVE-2026-109618 und CVE-2026-109619
- Google Cloud: Responding to core PHP vulnerabilities