PHP to Release 2 Critical Patches as EU Warns Some Sites May Need to Go Dark
Updated
Updated · Reuters · Oct 21
PHP to Release 2 Critical Patches as EU Warns Some Sites May Need to Go Dark
3 articles · Updated · Reuters · Oct 21
Summary
PHP said it will publish fixes at 1400 GMT for two vulnerabilities rated 9.2 and urged users to upgrade immediately once releases are available.
CERT-EU said the flaws could enable unauthenticated remote code execution, telling organizations to prepare immediate patching and consider taking affected websites offline if they cannot update quickly.
Cloudflare said early attacks were emerging and updated firewall rules as a temporary mitigation, while GoDaddy warned the bugs could lead to data theft, defacement or full system compromise.
PHP underpins much of the web, including WordPress, Drupal and Joomla, and Wordfence said automatic updates will not deliver the fix, leaving many site owners dependent on hosts or administrators to patch manually.
CERT-EU and Australia's ACSC said PHP 5 and later may be affected, though PHP has not yet disclosed the vulnerable versions and plans to publish full details with the patches.
With hackers already exploiting critical PHP flaws, is your website's hidden infrastructure a ticking time bomb waiting to be breached?
Will taking your website offline to avoid this critical PHP vulnerability ultimately cause more financial damage than the hackers themselves?
CVE-2026-109618/109619: Inside the October 2026 PHP Remote Code Execution Emergency and Its Global Web Impact
Overview
On October 20, 2026, an early leak exposed technical details of two critical PHP remote code execution vulnerabilities, prompting the PHP team to announce an emergency patch release. Security researchers confirmed the flaws, which exist in the PHP core engine and can bypass application-level protections, threatening popular platforms like WordPress and Laravel. Because many servers run unsupported PHP versions, over a million hosts will not receive official patches, leaving them open to attacks that can lead to server compromise and data theft. Regulatory bodies urged urgent action, while industry experts stressed that only direct PHP updates—not standard CMS updates—can address the risk.