Note: new updates are posted at the bottom.
A major security update for PHP is scheduled for Wednesday, 21 October. The PHP security team has announced that it will address two critical vulnerabilities, both with a CVSS v4.0 score of 9.2. The potential impact is significant: according to the European cybersecurity team CERT-EU, the vulnerabilities could allow remote code execution (RCE), potentially without requiring an attacker to authenticate first.
The security release is scheduled for today at 16:00 Netherlands time (CEST). Organisations using PHP should prepare now. Do not wait until the release is published to identify potentially affected systems and determine who is responsible for installing the updates.
Why does this matter?
PHP is the foundation of a large number of websites and web applications. These include environments running WordPress, Joomla and other content management systems, as well as online shops, custom applications and internal business applications. PHP may also be part of systems that do not immediately appear to depend on it.
CERT-EU states in its official security advisory that the vulnerabilities may affect PHP versions starting with PHP 5. The exact affected versions and available fixes should be confirmed using the official release information. The CVE identifiers mentioned in the advisory are CVE-2026-109618 and CVE-2026-109619.
There are also reports of potentially available proof-of-concept code. This reinforces the need to take the situation seriously, but it does not, by itself, prove that every PHP application is vulnerable or that successful attacks are taking place on a large scale. The full technical details are expected to be published by the PHP team alongside the security release.
What should administrators do now?
Use the time before the scheduled release to complete preparations. Do not wait until the patches become available before starting your inventory.
1. Identify all PHP systems. Inventory websites, web applications, containers, servers and hosting environments running PHP. Also check systems managed by external suppliers or hosting providers.
2. Confirm who is responsible for updates. For managed or shared hosting, check when the provider will make the security updates available and install them. Do not assume that this will happen automatically without verifying it.
3. Prepare for a rapid, controlled update. Check which PHP versions are in use, how updates will be deployed and whether a rollback procedure is available. Consider compatibility and testing requirements, but do not unnecessarily delay essential security measures.
4. Follow the official release. As soon as the release is published, check which versions are vulnerable and which updated versions address the issues. Install the appropriate security update as soon as possible, then verify that the applications are actually running a fixed version.
5. Assess temporary risk reduction measures. If immediate patching is not possible, CERT-EU advises considering isolating internet-facing applications from public networks until a fix can be applied. Assess this measure in the context of your environment and its impact on service availability. A firewall or other additional protection should not be treated as a substitute for a security update without a sound technical basis.
6. Check for suspicious activity. Pay particular attention to web server logs, application logs and alerts from existing security monitoring systems. Investigate anomalies using your established incident response procedures and preserve relevant log data.
Follow the official information
For organisations in Europe, the CERT-EU security advisory is an important central reference. It describes the severity of the vulnerabilities and advises organisations to prepare for immediate patching. The information may be updated as further technical details become available.
Official European security advisory:
CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP
Also consult the announcement from the PHP security team for the official schedule and the publication of affected and fixed versions:
PHP.net, Upcoming Critical PHP Security Release
For additional coverage in Dutch, see the article from Tweakers:
Tweakers, PHP warns of two serious bugs that appear easy to exploit
Conclusion, be ready to act
Today's planned PHP release deserves the attention of every organisation that manages PHP systems or relies on a third party to manage them. The combination of two critical vulnerabilities, a CVSS score of 9.2 and the potential for remote code execution makes a rapid and well-prepared response essential.
Use the time before 16:00 to inventory your PHP environment, confirm responsibilities and prepare your update process. Then check the official release information immediately, install the appropriate security updates and verify that your systems have actually been updated. If immediate patching is not possible, carefully assess the temporary isolation of internet-facing applications as advised by CERT-EU.
When dealing with critical vulnerabilities, preparation is not a formality. It is an essential part of reducing risks to websites, applications and the data they process.
New updates
Update at 14:00 Dutch time
At this moment, no new information is available from official sources. However, more and more websites appear to be temporarily going offline as a precaution. The websites mijnoverheid.nl, tweedekamer.nl and digid.nl are among those being mentioned.
Because details of the vulnerabilities were leaked prematurely last night, before PHP itself had published any information or a solution, there is additional uncertainty about the potential risks and the time available to prepare.
PHP has announced that it plans to publish a security release later today, Wednesday 21 October 2026, at 16:00 Dutch time. According to the PHP team, this release will contain fixes for both vulnerabilities. PHP also states that it reserves the right to release the updates earlier if details of either vulnerability become public or if there is evidence of active exploitation.
As far as is currently known, there is no confirmed temporary measure that fully addresses the vulnerabilities. It is therefore advisable to follow official announcements closely, prepare in advance to install the updates, and assess whether systems should temporarily be restricted or taken offline. Once the official information and patches become available, it is important to assess the necessary measures and how quickly they can be implemented on a case-by-case basis.
Update at 15:00 Dutch time
Official updates containing substantive new information are still pending.
The PHP Foundation has indicated through news agency ANP that there are currently no indications of active exploitation of the vulnerabilities. According to NOS, the Dutch National Cyber Security Centre (NCSC) has also reported no indications of active exploitation at this time.
Officially, only PHP versions 8.2 through 8.5 are currently supported. Given the potential severity of the vulnerabilities, it is not yet clear whether older PHP versions will also receive security updates. The vulnerabilities appear to date back to PHP 5.4.0, released in March 2012. Whether and to what extent older or newer versions are actually vulnerable, and whether fixes will be made available for them, remains to be seen in the official information from the PHP team later today.
According to one of PHP's core developers, installing the security updates is the only way to properly protect systems against these vulnerabilities.
Update at 16:00 Dutch time
The security updates for PHP are now available. They were released even slightly earlier than the announcement itself. PHP has confirmed two critical vulnerabilities that could allow remote code execution without requiring authentication.
The updates are available for PHP 8.2 until 8.5. The respective patched versions are (and later versions):
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
PHP strongly advises users to update as soon as possible.
The vulnerabilities may affect various PHP environments, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to the PHP team, the risk is highest with mod_php, where an attack has been demonstrated that can be carried out before application code is executed.
The PHP project no longer provides regular updates for PHP 8.1 and older versions. Some Linux distributions and vendors may still provide security updates. The PHP team has also made limited patches available for PHP 7.4, 8.0 and 8.1 in specific situations where users build PHP from source themselves or cannot receive updates through a vendor.
PHP states that there is no complete temporary workaround: only installing a security update provides full protection. Some measures can limit specific attack paths, but they do not make a vulnerable installation completely secure.
The full security advisory, including technical details and instructions, is available in the official announcement on the PHP.net homepage. Which update is available and how best to install it depends on the PHP version, application and environment in use.