PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 out of 10 that allow unauthenticated remote code execution.
Finland, the Netherlands, and France took government websites offline as a precaution after details leaked early and Cloudflare reported attacks hours before the fix shipped.
Regular users have nothing to install; the fix falls on website owners and hosting companies, and PHP 8.1 and older get no official release.
If you’ve been online at all today, you’ve seen the panic: a critical vulnerability is threatening to “pwn” just about every website on the planet.
Finland just started unplugging government websites on Wednesday, the NSA is recommending all organizations using PHP to shut down their sites, and the Netherlands and France did the same. And no, it wasn't a cyberwar.
Myriad: Which company will IPO next? Click to make your prediction.
The culprit was PHP, a programming language most people have never heard of. You've almost certainly used it today, though: it runs about 70% of all websites whose server-side language is known, according to W3Techs.
PHP is the software working behind the curtain on a website's server—the computer that stores the site and builds each page you ask for. Every WordPress site, for example, sits on a PHP server, per WordPress security firm Wordfence.
Oh, by the way, Wordfence is also down.
Two newly found bugs in PHP itself let a stranger run their own commands on that server without ever logging in. Security people call this unauthenticated remote code execution. Everyone else can call it "someone else is driving now."
If that server stores your account, your address, or your order history, well, that's theirs too. Web host GoDaddy warned the flaws could let attackers steal data, deface sites, or take over servers entirely.
“A flaw like this could let an attacker run their own code on an affected server over the internet, which can lead to stolen data, a defaced site, or a full takeover,” Godaddy says.
What PHP announced
The PHP Foundation, the nonprofit that funds the language's development, raised the alarm on Tuesday. In a statement shared on X, it said: "The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence."
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026
That 9.2 comes from CVSS, the Common Vulnerability Scoring System, which grades how dangerous a bug is based on things like how easily it can be reached over the internet and how much damage it can do. It runs from 0 to 10, and anything from 9.0 up is labeled critical—so these two are about as bad as it gets without hitting a perfect 10.
The fix landed at roughly 13:35 UTC on Wednesday, a few minutes early, as PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The security advisory didn't bother being subtle: "All PHP users are strongly encouraged to update immediately."
But releasing a fix and having everybody implement the solution are not the same thing, so caution is advised.
How the bugs work
The first bug, CVE-2026-109618, shows up when PHP runs out of memory halfway through handling a request, then later treats that half-built data as if it were finished. The second, CVE-2026-109619, lets leftovers from one visitor's request linger in memory after they should have been tossed, where the next request can trip over them.
Think of a cook who keeps reading orders from tickets that are already in the trash. Slip a fake ticket into the bin, and the cook makes whatever you wrote on it. In this case, the “order” is the attacker’s code, and the server runs it.
PHP said the risk is highest on servers using a common Apache setup called mod_php, where a demonstrated exploit works "before any application code runs." In other words, the website's own defenses, like login screens and WordPress security plugins, never even wake up.
PHP foundation researchers pointed at PHP's upload-progress feature, the thing that tracks how much of a file you've sent, as one of the confirmed ways in. It has been switched on by default for more than a decade, and few websites actually use it.
A leak, then attacks
None of this was supposed to be public yet. On Tuesday, someone posted on the Hacker News forum that two PHP flaws would be disclosed that Thursday, while admitting they had "no evidence beyond 'source: trust me, bro.'"
Turns out bro was right. Security firm watchTowr confirmed the bugs were real and under embargo—an agreement to keep details quiet until a fix is ready—and PHP moved its release up a day.
"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Cloudflare CTO Dane Knecht wrote on X early Wednesday morning, nearly six hours before the patch shipped. Cloudflare pushed emergency firewall rules, filters that block known attack patterns, to every customer, but Knecht called them "a stopgap only."
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show… https://t.co/wMz9tDTWwH
— Dane Knecht 🦭 (@dok2001) October 21, 2026
Governments hit the off switch
Finland's state IT center, Valtori, began taking public web services offline as a precaution, public broadcaster Yle reported, while the Dutch national cybersecurity agency took down its own website.
France's Interior Ministry said its prefecture websites were "temporarily taken offline pending the release of a security patch by the framework's publisher."
CERT-EU, the EU's cyber emergency team, told organizations that couldn't patch to "consider isolating internet-facing applications from public networks until a fix is available." That's bureaucrat-speak for "unplug it." Agencies in Australia, Japan, and the U.K. said much the same, according to Reuters.
What the viral posts got wrong
Viral threads on X claimed PHP versions "dating back to 2004" were vulnerable. That traces back to early estimates that everything since PHP 5 was affected, which CERT-EU admitted is based on social media posts.
E-commerce security firm Sansec puts the range at PHP 5.4 and later. So 2012, not 2004—still plenty old.
PHP only ships official releases for versions 8.2 and newer, which makes the "no fix for old versions" claim half right. Given how bad this one is, its security team also published bare-bones source-code patches for 7.4, 8.0, and 8.1, and Linux distributions are backporting fixes of their own.
Security firm Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older on October 20, or 59% of the roughly 1.5 million that publicly show a version. A single shared-hosting server can carry many websites, so the number of sites behind them is higher.
Some threads also lumped in Node.js, a different web technology that happened to schedule its own, unrelated security update for the same day. Bad timing.
Even patched versions won't reach every server at once. "If you rely on the volunteer maintained https://rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today," the PHP Foundation said in its statement, referring to a popular volunteer-run source of PHP packages for Red Hat-style Linux servers.
Should you really care?
You shouldn’t panic, but also shouldn’t shrug it off. A hacked website, for example, doesn't need to touch a blockchain to empty your wallet. In 2024, attackers redirected the front ends of DeFi protocols Compound and Celer to pages that drained connected wallets, and Curve Finance suffered a similar attack in 2025.
I pre-emptively disconnected ALL my sites / VPS servers from the web
I'll wait for the patch to hit at 2 PM UTC
If you have a PHP website, probably good to take them down until you patch PHP
69.3% of the web runs on PHP so this is going to be intense!
Good time maybe to buy… https://t.co/xTXvLwuzrH
— @levelsio (@levelsio) October 21, 2026
Those were DNS hijacks, not PHP bugs, but the trick is the same: the site looks right, the URL looks right, and the "approve" button sends your tokens somewhere else. A compromised server can serve exactly that kind of page.
Hackers can get very creative, very fast, when it comes to zero-day exploits.
Bugs like these are also getting easier to find, with frontier AI models increasingly used to find software vulnerabilities, and experts told Decrypt in June that many more vulnerabilities could surface as those tools spread.
What happens next, and what to do
Once a patch is public, attackers can compare the old and new code to see exactly what was fixed, and the forensics team at cybersecurity firm Sansec said it expects "mass attacks to start within 15 minutes of the release." When a different PHP flaw went public in June 2024, Akamai experienced exploit attempts against its decoy servers within 24 hours.
So should the average person panic? Not exactly. Your phone, browser, and laptop don't need a PHP patch; the work falls on whoever runs the websites you use.
If you run a site, ask your hosting provider whether PHP has been updated, and don't count on WordPress to do it for you: Wordfence warned that automatic updates won't apply this fix and told site owners to find out who is responsible for updating PHP on their servers. Anyone on 8.1 or older needs to plan an upgrade.
"The only thing I can say is that the only mitigation is patching / upgrading PHP,” PHP core developer Gina Peter Banyard said on Mastodon. “I sadly know too much."
And if you're on PHP 8.2, the fix you just got is one of your last: that version reaches end of life on December 31, 2026, after which it gets no more security patches.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.Add on GoogleAdd Decrypt as your preferred source to see more of our stories on Google.
