Critical PHP Vulnerabilities Disclosed: Is Your Website at Risk?

On 21 October 2026 the PHP development team issued a security advisory covering 2 critical remote code execution vulnerabilities, both assigned CVSS 4.0:9.2 (highest risk category) and affecting PHP installations handling web requests (essentially all web-facing installations).

If your website or application runs on PHP or a platform (e.g., WordPress, Magento, Laravel) built using PHP, this advisory affects you and the changes you need to consider implementing are urgent, not deferred to the next scheduled maintenance cycle.

What Are the Vulnerabilities?

CVE-2026-109618 - Critical Remote Code Execution (CVSS 9.2)

Improper handling of out-of-memory conditions in PHP allows an attacker to execute arbitrary code on the targeted server. Exploitation does not require authentication.

CVE-2026-109619 - Critical Remote Code Execution (CVSS 9.2)

A memory-management vulnerability involving stale internal application state. Similarly exploitable for remote code execution on a vulnerable server. Both vulnerabilities affect PHP-FPM and PHP-CGI configurations, the deployment setups most commonly used in production web hosting.

Should Your Business Be Concerned?

PHP runs an enormous percentage of the internet. WordPress alone powers 40% of all websites. Magento, Laravel, Symfony, Drupal, and countless custom-built applications all use PHP as their core language. The question is not whether PHP is used, it obviously is. The question is whether the version running on your server is vulnerable.

If it is, and it remains unpatched, the potential impact includes:

• Remote execution of unauthorised code on your server, without any login required from the attacker
• Full or partial compromise of your website or application
• Exposure, theft or modification of customer and business data
• Website downtime, service disruption, and the reputational damage that comes with it

This is not a vulnerability class where you can assume the risk is low because your site is small or not especially high-profile. Automated scanning tools find vulnerable servers at scale. A site does not need to be a specific target to get hit.

The PHP development team’s guidance is clear: updating to a fixed version is the only way to fully remediate this class of attack. Temporary measures such as modifying WAF rules or adjusting firewall policies to block suspected IPs can reduce the attack  on surface level but are not a true replacement for a patched PHP installation.

What You Should Do Right Now

If you manage your own server or have a technical team in place, the steps are:

• Check which PHP version is running across your production, staging and testing environments
• Cross-reference against the versions listed in the PHP security advisory as vulnerable
• Test application compatibility against the patched PHP version, particularly important for older applications or those with legacy dependencies
• Apply the security update and verify the corrected version is active
• If any of your environments are unable to be patched immediately, ensure you consider their exposure and possible containment until a patch can be applied.

The compatibility check before making a patch is also something to seriously consider, especially if there has been some time since your application has had a PHP version update.

 Legacy codebases often have dependencies which break when a PHP version update occurs. This does not mean you should avoid making the necessary security changes, but it does mean the upgrade path needs to be planned and tested rather than implemented blindly.

How Dotsquares Can Help

If you do not have an in-house technical team, or your current setup means you are not sure who is responsible for server-level security on your platform, we can help you get clarity quickly.

Dotsquares offers PHP development services for businesses using PHP-based platforms and custom applications, ranging from WordPress and Magento to bespoke Laravel solutions. Our team can assess your environment, determine if you are running a vulnerable version, and help with the necessary processes in place (including the testing required) to make sure your application is secure.

Given the severity of these vulnerabilities, we would suggest not waiting. A short consultation this week is a lot less disruptive than dealing with a compromised site.

Not sure if your environment is affected? We can check. Get in touch for a short security consultation and we will tell you exactly where you stand.

Book a Free Consultation