By Aaron Hammond 
Two critical security vulnerabilities reportedly affecting PHP have prompted an urgent warning to organisations that use the programming language. The reported flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code on vulnerable systems.
The warning advises organisations to update affected PHP installations immediately. Where an organisation cannot apply an effective fix, it should consider taking the affected system offline until it can secure it.
What the Two PHP Vulnerabilities Mean
PHP is a programming language that helps websites process information, handle forms and connect to databases. Many websites and online services depend on it to function properly.
The main concern is that attackers could exploit the reported flaws to execute malicious code remotely. In simple terms, this could allow an attacker to interfere with a vulnerable server without first gaining normal access to the system.
The two vulnerabilities carry a reported severity score of 9.2 out of 10. According to Google Cloud’s security guidance, affected PHP versions include versions 5.4 through 8.5.11. The risks may include unauthorised access, data theft and disruption to online services.
Which PHP Versions Need an Update?
The PHP development team released security updates on October 21, 2026, to address both vulnerabilities. The fixed versions include PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12. Organisations should confirm the correct update for their installed version before proceeding.
Organisations running PHP 8.1 or older face an additional challenge because those versions no longer receive official security updates. Google Cloud recommends upgrading to a supported PHP version rather than relying on outdated software. Website owners should also check their hosting services, content management systems and third party applications to identify any bundled PHP installations.
What Organisations Should Do Now
Organisations should first identify every server and application running PHP, especially systems accessible through the internet. Their technical teams should install the appropriate security updates and redeploy affected applications where necessary.
If an immediate update is not possible, security agencies recommend isolating vulnerable internet facing applications from public networks until administrators can apply an effective fix. Teams should also monitor web servers for unusual activity, including unexpected command shell launches and suspicious file downloads.
If administrators suspect a breach, they should isolate affected systems, preserve server logs and report the incident through the appropriate cybersecurity reporting channels. These steps can help investigators understand what happened and reduce the risk of further damage.
For the latest technical instructions, organisations should consult the official PHP website , the CERT EU Security Advisory 2026 018 and Google Cloud’s security guidance .
The message for website owners and IT teams is straightforward: check your PHP version and apply the appropriate security update without delay. A website that works perfectly today can still carry a serious security risk if its underlying software remains vulnerable.
Also Read: Are AI Phones Worth It? Inside the Latest Mobile Technology Trends