Exposure assessment
Locate PHP installations and long-running processes, check package provenance and establish a prioritised remediation plan.
21 October 2026 | Critical PHP security update
Urgent PHP security updates and practical recovery support
Two newly disclosed critical PHP vulnerabilities can allow unauthenticated attackers to run code on affected servers. If your business relies on a PHP-powered website or application, now is the time to verify the runtime is patched.
Warsash Software Engineering can help assess exposure, coordinate safe server updates, test existing applications and investigate signs of trouble - including Laravel, WordPress and older PHP platforms.
What has happened?
On 21 October 2026, the PHP project published fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities rated 9.2 under CVSS v4.0. Depending on the runtime and configuration, an unauthenticated attacker could potentially execute code on a vulnerable server. These flaws affect PHP itself, not just a particular CMS or framework.
Minimum patched upstream PHP versions
- PHP 8.5: 8.5.12 or newer
- PHP 8.4: 8.4.27 or newer
- PHP 8.3: 8.3.36 or newer
- PHP 8.2: 8.2.35 or newer
- PHP 8.1 and older: no supported upstream security release; plan a migration to a supported branch
These are PHP project's upstream releases. Distribution-maintained packages may carry verified security backports and different version labels: check the actual vendor advisory and running interpreter, not just a version string.
Updating WordPress, Laravel or a plugin alone does not replace a vulnerable PHP runtime. The PHP project says there is no complete workaround in place of applying the fixed PHP security update.
What should you do now?
- Identify your PHP estate. Check production and staging servers, web-facing PHP-FPM or Apache, CLI processes, containers, queue workers and any third-party products that bundle PHP.
- Verify the installed and running versions. Ask your hosting provider to confirm whether all exposed runtimes contain the fixes, including vendor-backed packages.
- Patch and test. Back up appropriately, deploy patched PHP packages, restart the relevant long-running processes and smoke-test key user journeys and integrations.
- Review exposure. Monitor logs and suspicious activity. If safe patching is not immediately feasible, follow the UK NCSC's advice to consider taking affected systems offline until secured.
How Warsash can help
Hands-on support from our engineering team, led by founder Chris Buckle, a senior PHP and Laravel engineer with extensive experience maintaining business-critical software and Linux hosting environments.
Patch and validate
Plan safe upgrades, apply supported fixes and test Laravel, WordPress and bespoke PHP applications for compatibility and regressions.
Stabilise and review
Check relevant logs, investigate operational anomalies, assist recovery where needed and document the verified patch state.
Unsure whether your website is protected?
Get in touch with a brief description of your website or application, hosting provider, known PHP version and any current service issues. We'll help establish a sensible next step.
Please do not include server passwords, API keys or other credentials in your initial message.
Authoritative security guidance
Published 21 October 2026. Follow these sources for subsequent updates and the advice applicable to your specific deployment.