A security advisory surrounding two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, prompted widespread maintenance and emergency updates across websites on 21 October 2026. The flaws could allow an attacker to run malicious code on an affected server without authenticating, potentially stealing data, altering website content, or enabling a backdoor.
In some configurations, an exploit could be triggered before the website’s own code even executes, making risk pervasive across PHP installations that serve web requests. Early attacks were reported by Cloudflare’s CTO, with warnings that standard firewall mitigations are only a stopgap.
Emergency patches are now available across PHP’s supported lines: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators urged to update promptly through their hosting providers or operating system vendors. While updates are being applied, some sites may remain offline or operate in maintenance mode. CERT-EU also recommends identifying PHP-based applications and patching as soon as possible, or isolating internet-facing applications if immediate fixes are not feasible.
There is a longer-term concern about forgotten or unsupported PHP instances, including PHP 8.1 and older, which no longer receive routine updates; administrators should verify vendor fixes or upgrade to a supported version.
For visitors, temporary downtime may reflect protective updates rather than a breach, but users should remain cautious of unexpected redirects or downloads and avoid interacting with suspicious content. Websites’ owners should confirm that fixes are installed across all sites, and manage PHP updates separately from application-level software such as WordPress and plugins.