Critical PHP flaws let attackers take over web servers (October 2026)

What happened?

On October 20, 2026, the PHP project warned that an emergency release was coming the next day. On October 21 it shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical flaws. The project’s advisory says both could let an attacker run their own code on a web server, without signing in, and rates each 9.2 out of 10 on the CVSS v4 scale.

• CVE-2026-109618 is a memory-handling flaw. PHP’s advisory shows it can be triggered by a crafted form upload.
• CVE-2026-109619 is a flaw in how PHP cleans up between requests. Its advisory lists PHP 8.5’s error backtraces and session upload progress as ways in.

Who’s affected?

The PHP team says the risk covers all PHP installations serving web pages, including the common setups hosts use. WordPress runs on PHP, so almost every WordPress site sits on a server that needed this fix.

The flaw is in PHP itself. No WordPress, theme or plugin update can fix it. Only whoever runs the server can.

Sites on PHP 8.1 or older are in a worse spot. Those versions are past their end of life, and the advisory says they no longer get updates from the PHP project. Because the flaws were so serious, the team published bare-bones fixes for 7.4, 8.0 and 8.1, but a host or support vendor has to apply them.

Is it being attacked?

Yes. Singapore’s Cyber Security Agency reported widespread attempts to exploit it. WP Engine said its firewall blocked more than one million related requests in the first 24 hours, with no successful attacks seen on its platform.

What did the big WordPress hosts do?

• Pressable said on October 21 that every site on its platform, on every PHP version it offers, was already protected, and customers didn’t need to do anything.
• WP Engine said it added firewall rules and settings changes overnight, then installed the official fixes, and that customers don’t need to act.

Other hosts vary. If yours hasn’t said anything, ask.

What should I do?

1. Ask your host whether your server’s PHP has the October 21 fixes. You don’t need to know the technical detail; the question is enough.
2. Check your PHP version. See whether your site is on an old PHP or WordPress. If it’s 8.1 or older, plan the upgrade now.
3. If you run your own server, update PHP and restart every PHP worker. The advisory lists partial workarounds but says they don’t make a server safe; updating is the only safe choice.
4. Watch for signs of a hack over the coming weeks. If you see any, follow what to do if your site was hacked.

How does E-3 handle this?

E-3 keeps the sites it hosts on supported PHP versions: the versions the PHP project fixed on October 21. Our monitoring of hosted sites covers PHP versions, waiting updates and known plugin vulnerabilities. We also send security alerts and keep daily backups. If you’re an E-3 hosting client and want to confirm where your site stands, call or email us.

Sources

1. Security advisory: Critical remote code execution vulnerabilities, update now (PHP.net, October 21, 2026)
2. RCE via OOM corruption, CVE-2026-109618 (PHP security advisory GHSA-w8hw-w9fx-j79w)
3. RCE via stale global state, CVE-2026-109619 (PHP security advisory GHSA-6wmf-4rv5-p3rp)
4. Critical vulnerabilities in PHP, alert AL-2026-151 (Cyber Security Agency of Singapore)
5. Your Pressable sites are already protected from the recent critical PHP security update (Pressable, October 21, 2026)
6. Two critical CVEs affecting PHP (WP Engine, October 22, 2026)
7. Supported versions (PHP.net)