PHP Warns of Two Critical Flaws, Patches Due October 21

The PHP security team has warned of two critical PHP vulnerabilities, each rated 9.2 under CVSS v4.0, and scheduled an urgent security release for October 21, 2026, at 14:00 UTC. The announcement, issued on October 20, urges administrators to prepare for updates before the full technical details become public.

The warning matters to organizations operating PHP-based websites, business applications and hosting infrastructure. PHP is widely used by platforms including WordPress, Drupal, Joomla and Magento, making a serious vulnerability in the underlying runtime potentially relevant to a broad range of services.

PHP Confirms Two Critical Security Vulnerabilities

In an official security announcement, PHP maintainers provided advance notice of an upcoming release covering two vulnerabilities with identical CVSS v4.0 severity scores of 9.2.

The unusually early warning gives organizations time to identify PHP installations, coordinate maintenance and prepare to deploy fixes when they become available.

PHP maintainers also said the release could be brought forward if vulnerability details become public or evidence of active exploitation appears.

European Cybersecurity Agency Warns of Possible Remote Code Execution

The European Union’s Computer Emergency Response Team, CERT-EU, published Security Advisory 2026-018, identifying the reported vulnerabilities as CVE-2026-109618 and CVE-2026-109619.

The agency warned that information circulating ahead of the official disclosure suggests the vulnerabilities could enable remote code execution. However, it also acknowledged that technical details were not yet publicly available.

Security researchers have circulated claims that a wide range of older PHP versions could be affected. BleepingComputer reported those claims while highlighting differences between leaked information and PHP’s official statement.

These reports should not be treated as a definitive affected-version list. The PHP team has said that supported details, including affected and fixed versions, will accompany the security release.

Why WordPress and Hosting Providers Should Pay Attention

WordPress relies on PHP to execute server-side application code. The same underlying runtime is used by many other publishing systems, e-commerce platforms and custom applications.

A vulnerability in PHP itself is different from a security issue in a WordPress theme, plugin or WordPress core component.

Consequently, updating WordPress does not necessarily update the PHP interpreter running the website.

Infrastructure teams should also distinguish the PHP version reported by a command-line shell from the version serving web requests through PHP-FPM or another server integration. Running php -v can identify the command-line version but does not necessarily establish which interpreter every website uses.

What Server Administrators Should Do Before the Fixes Arrive

CERT-EU recommends preparing to patch affected PHP installations as soon as fixes become available. For systems where immediate remediation is not possible, it advises considering isolation of internet-facing applications until the relevant update can be applied.

Administrators can use the remaining preparation window to address five operational priorities:

1. Identify PHP installations. Inventory production web servers, PHP-FPM pools, containers, hosting environments and application runtimes. Record their actual serving versions and update owners.
2. Prepare a maintenance window. Review application compatibility, package repositories, container image dependencies and the ability to restart or replace PHP processes safely.
3. Verify backups and rollback procedures. Ensure important files, configurations and databases can be restored if a deployment causes compatibility problems.
4. Coordinate with hosting providers. Shared and managed hosting customers should confirm how their providers distribute PHP security updates and whether any customer action is required.
5. Monitor official release information. Use PHP’s published advisories and trusted operating-system vendor notices to identify the correct fixed packages. Avoid relying solely on unconfirmed version lists or unverified third-party downloads.

Operators of Ubuntu-based infrastructure can also review the server maintenance and update practices described in the Servers.News Ubuntu 26.04 LTS server setup guide.

For larger infrastructure fleets, exposure-based prioritization can help identify the most urgent systems. Servers.News has previously examined security update prioritization and controlled automation in enterprise server administration.

What Happens When PHP Publishes the Security Fixes?

The security release is scheduled for October 21 at 14:00 UTC. Once published, the official advisories should establish which PHP versions are affected, which versions contain fixes and what technical conditions are required for exploitation.

Administrators using Linux distribution packages should also check their distribution’s security notices. Vendors may backport fixes into maintained package branches rather than adopt the latest upstream PHP version number.

After updating, teams should verify the PHP runtime actually serving requests, confirm the relevant fixed packages are active and test application behavior.

If credible evidence of exploitation subsequently emerges, response procedures may need to extend beyond installing updates to include incident investigation and credential reviews.

For now, PHP’s warning represents a significant advance security notice rather than evidence that every PHP-powered website has been compromised. The immediate priority is preparation, followed by verified remediation when the official fixes become available.

Reporting reflects information available before the scheduled October 21, 2026, security release. Sources include the PHP security team’s official announcement, CERT-EU Advisory 2026-018 and independent reporting by BleepingComputer. Affected-version details and release status should be rechecked before publication or subsequent updates.