Your website probably runs on PHP. The critical fix to make today

The PHP project has released emergency updates for two critical flaws that can let an attacker take over a web server without logging in. If your business, school, church or municipality runs a website on WordPress, Joomla, Drupal or Magento, the server underneath it almost certainly runs PHP, and it needs to be updated now.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026 (PHP security advisory).

What is the PHP flaw?

There are two bugs, tracked as CVE-2026-109618 and CVE-2026-109619. PHP says both can allow "unauthenticated remote code execution", meaning someone on the internet can run their own commands on your server (PHP). Each one is rated 9.2 out of 10 for severity (TechCentral, via Reuters).

The first bug is triggered when PHP runs out of memory partway through handling a request. The second involves leftover data from one request being reused by the next one on the same server process (UK National Cyber Security Centre). Technical details are in the two PHP advisories on GitHub (advisory 1, advisory 2).

Which websites are affected?

PHP says the flaws affect all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for Apache with mod_php, where a working exploit can strike before any of the site's own code runs (PHP).

The UK's National Cyber Security Centre says organisations using any version of PHP are affected (NCSC). Security firm Huntress pointed out that PHP sits underneath WordPress, Drupal, Joomla and Magento sites, shared hosting and control panels (TechCentral, via Reuters).

That covers a large share of South African small business sites, online shops and hosted company pages.

Are attackers already using it?

Cloudflare's chief technology officer, Dane Knecht, said the company was seeing early attacks and was updating its firewall rules as a stopgap (TechCentral, via Reuters). Cloudflare says it switched on default web application firewall protections for its customers (Cloudflare).

In Europe, some organisations took websites offline after the EU's computer emergency response team, Cert-EU, said sites that could not be patched should be considered for removal from the internet (TechCentral, via Reuters).

What should you do if you have a website?

Official advice from PHP and the NCSC comes down to a few steps:

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's patched package (PHP).
• If you run an older PHP version that no longer gets updates, ask your vendor for a backported fix or move to a supported version (PHP).
• Check other software and appliances that bundle PHP, and apply their updates as they arrive (NCSC).
• If you can't patch or apply PHP's temporary workarounds quickly, the NCSC says to consider taking the system offline until it is fixed (NCSC).

Most people on shared hosting don't control the PHP version themselves. Ask your hosting company whether your server is on a patched release, and get it in writing.

Will WordPress update this automatically?

No. Wordfence, which makes a WordPress security plugin, warned that WordPress's automatic updates will not apply this fix because PHP is server software, not part of WordPress. It advised site owners to find out who is responsible for updating PHP on their site (TechCentral, via Reuters).

Updating your plugins and themes is still sensible, but it does not close this hole.

What if my site was hit before I patched?

The NCSC says systems that stayed exposed should be checked for signs of compromise, including backdoors left by attackers, and that organisations without the skills to do this should bring in an incident response provider (NCSC).