MeanCEO: Tech Startups and Startup Ideas

PHP Vulnerability: Two Critical Flaws Get an Emergency Fix Today. What Founders With PHP Sites Should Do

TL;DR: What is the PHP vulnerability everyone is searching for?

On 20 October 2026, the PHP security team announced an emergency release for two critical vulnerabilities in PHP, the language behind WordPress, WooCommerce, Magento, Laravel and most of the web. PHP rated both flaws 9.2 out of 10 (CVSS v4.0), and the fix came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP confirms both bugs allow unauthenticated remote code execution, which means an attacker can take over the server without logging in. PHP says there are no complete mitigations, so update today, and ask your host when they install it. PHP 8.1 and older get no official release.

Developing story. Last updated 22 Oct 2026, 14:25 CEST. Attack attempts are being reported, and no successful break-in has been confirmed so far. We will keep updating this article as PHP, CISA and the security firms publish more.

Update 22 Oct, 14:25 CEST: Attackers are trying, and nobody has confirmed a successful break-in yet. Amazon's threat intelligence team says its honeypots caught a first attempt on 17 October, four days before the disclosure, then more attempts from several groups from 02:00 UTC on 21 October, and it now calls php2shell "broadly exploited in the wild", while adding that it can't tell whether any attempt would have worked on a real server. The Dutch National Cyber Security Centre (NCSC-NL) wrote at 13:00 on 22 October that it has no signals of successful exploitation and that none of the circulating proof-of-concept exploits it tested worked yet. Sansec's 22 October update says mass exploitation looks less likely than it expected on release day, because a researcher found the public exploits don't work on a default PHP install. The US agency CISA told everyone on 21 October to patch at once and to take systems offline if they can't update, and neither CVE is on its Known Exploited Vulnerabilities list as of its 21 October catalogue. On the hosting side, Hostinger says the fix is on all its hosting servers except VPS, GoDaddy has finished Managed WordPress and Windows hosting, and cPanel and CloudLinux shipped patched PHP builds for the servers they run. My advice stays the same: patch today, and if a server was exposed, check its logs back to 17 October, as Amazon recommends.

Update 21 Oct, 15:50 CEST: PHP has released the fix. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP's security advisory confirms that both flaws allow unauthenticated remote code execution: CVE-2026-109618 comes from out-of-memory handling while PHP parses multipart requests (such as file uploads), and CVE-2026-109619 from internal data that survives after its memory has been freed. Every PHP setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and PHP rates the risk highest for mod_php. In PHP's words: "There are no complete mitigations, updating is the only safe choice." PHP 8.1 and older get no official release; the security team published minimal source backports for 7.4, 8.0 and 8.1 and points users to their Linux distribution or long-term support vendor.

A critical PHP vulnerability pair is the reason "PHP" and "PHP vulnerability" shot up Google Trends in the US overnight, with thousands of searches and a +300% jump. If your startup runs a WordPress site, a WooCommerce shop, a Laravel app or any PHP admin panel, this one is about you, and today is the day to act. It wasn’t the only security fire that day: a Railway breach and a poisoned LiteLLM release also put founders’ API keys at risk.

Here is what PHP confirmed, what is still unconfirmed, and the exact steps I would take today as a founder with PHP sites.

What did PHP announce on 20 October 2026?

On 20 October 2026, the PHP project posted an advance notice of a critical security release on php.net. The notice is short, and every word counts:

the release was scheduled for Wednesday 21 October 2026 at 14:00 UTC;
it fixes two critical vulnerabilities, both rated CVSS v4.0 9.2;
PHP tells all users to "prepare now so they can upgrade as soon as the release is available";
PHP reserves the right to release earlier if details of either flaw become public or if attacks appear;
full details, affected versions and fixed versions come with the release.

CVSS stands for Common Vulnerability Scoring System, the standard 0 to 10 scale for how dangerous a security flaw is. Anything from 9.0 up counts as critical. The current PHP releases, 8.5.11, 8.4.26, 8.3.35 and 8.2.34, came out on 24 September 2026, so every server running PHP today is waiting for this fix.

Why is everyone searching for the PHP vulnerability right now?

The story leaked. According to BleepingComputer, a Hacker News post on 20 October claimed two PHP remote code execution flaws were coming, and the security firm watchTowr then confirmed it. watchTowr CEO Benjamin Harris told BleepingComputer the bugs were under embargo until Thursday 22 October. PHP moved the release forward to Wednesday.

An embargo is the quiet period that lets hosting companies and Linux distributions prepare patched builds before the public hears about a bug. As Beazley Security put it, the leak broke that window. So attackers now know a critical bug exists, and many hosts had less time to prepare.

What we know	Status
Two critical flaws, CVSS v4.0 9.2 each	Confirmed by PHP
Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 Oct 2026)	Confirmed by PHP
CVE numbers CVE-2026-109618 and CVE-2026-109619	Confirmed by PHP
Unauthenticated remote code execution (server takeover)	Confirmed by PHP
Affects every PHP version before the fixed releases	Confirmed for 8.2 to 8.5; researchers say back to PHP 5
No official release for 8.1 and older	Confirmed by PHP (source backports only)
Attacks in the wild	Attempts reported since 17 Oct; no confirmed break-in as of 22 Oct

CVE stands for Common Vulnerabilities and Exposures, the public ID for each bug. Some researchers call the attack chain php2shell, and Sansec says a screenshot of an exploit tool with that name leaked alongside the advisory.

Is the PHP vulnerability already being exploited?

Here is where things stood on 22 October. Amazon saw a first attempt on its honeypots on 17 October and calls php2shell broadly exploited in the wild. watchTowr lists both flaws as exploited, with active attempts. Cloudflare switched on firewall rules for every plan, the free plan included, at 03:02 UTC on 21 October and reports attack traffic with changing payloads. On the other side, CISA said on 21 October that it had not observed exploitation, Huntress saw none on its partners' systems, and NCSC-NL found on 22 October that none of the public exploits it tested worked yet. So the attempts are real, and no successful break-in is public so far.

On release day Sansec expected mass attacks within minutes, because attackers compare the patched code with the old code to find the bug. By 22 October it had revised that view: mass exploitation looks less likely than it expected, since a researcher found the public exploits need a separate file-inclusion bug to work on a default install. Don't relax because of it. Code posing as an exploit is circulating, Tenable warns some of it may carry malware, and attackers keep looking for a version that works, so never run it against your own site and patch anyway.

The European angle is real too. Sansec's timeline says several Dutch sites went offline as a precaution on 21 October, including the tech site Tweakers, the Dutch House of Representatives (Tweede Kamer) and the national cyber security centre NCSC. If public institutions in the Netherlands take their sites down for a few hours, a founder can spend one afternoon on updates. By the evening of 21 October the list had grown to Pokémon HOME, Cygames games, Wikimedia's tools and government sites across Europe, and we track who went offline over the PHP issue, and when your startup should do the same.

Which PHP versions are affected, and which get a fix?

PHP's advisory lists every version before the fixed releases as affected. Here is the version to install for each branch:

Your PHP branch	Update to
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35 (security support ends 31 Dec 2026)
8.1, 8.0, 7.4	No official release: get a backported package from your distribution or host, then migrate
7.3 and older	No fix: migrate or take the site offline

And here is how long each branch keeps getting security fixes, from PHP's supported versions page:

PHP branch	Security fixes until	Status on 21 Oct 2026
8.5	31 Dec 2029	Active support
8.4	31 Dec 2028	Active support
8.3	31 Dec 2027	Security fixes only
8.2	31 Dec 2026	Security fixes only
8.1 and older	Ended	End of life, no official fixes

Researchers say the flaws reach back to PHP 5. Sansec writes that servers on PHP 8.1 or older will not get an official fix. That's a big group. W3Techs data from 21 October 2026 shows PHP runs on 69.3% of websites whose server-side language it can detect, and 34.8% of PHP sites still run PHP 7, 5 or 4. Add the PHP 8.0 and 8.1 sites, and by my count nearly half of all PHP websites (about 48%) run a branch with no official support.

What does the PHP vulnerability mean for your startup?

Most founders don't think of themselves as PHP users. You probably are. WordPress, WooCommerce, Magento, Laravel, Drupal, Joomla, phpBB, many CRMs and plenty of agency-built landing pages all run on PHP. Here's how I'd handle the next 24 hours:

Make a list today. Write down every website, shop, blog, staging site, forum and internal tool you run, plus the host for each one. Old marketing microsites and forgotten staging copies are the ones attackers find first.
Check the PHP version of each. Your hosting panel shows it, or run php -v on the server. Anything on 8.1 or older goes to the top of the list.
Message your host now. Ask one question: when will you install the PHP security release from 21 October? Many managed WordPress hosts and cloud platforms update PHP for you, but only you know if your cheap shared plan from 2019 does.
Update today. If you manage your own server, install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distribution's patched package, and restart every PHP worker. Take a full backup of files and database first.
Put a firewall in front. A web application firewall (WAF) filters bad requests before they reach PHP. Sansec reports that Cloudflare's emergency rules cover free plans too. Treat it as a stopgap; PHP core developer Gina Peter Banyard told Sansec that patching PHP is the only real fix.
Plan your way off old PHP. If a site runs PHP 7 or 8.1 and nobody can update it, decide this week: migrate it, rebuild it, or switch it off. An unpatched site on your domain puts your customers' data and your Google rankings at risk.

We covered a similar wake-up call three days ago, when Rank Math PRO shipped malware to WordPress sites. And if you build with AI coding tools, read how the OpenCode breach exposed saved API keys. The lesson is the same in both: the tools under your product are part of your security, whether you wrote them or not.

Outages and breaches hit small teams hardest, because there's no security department to call. Yesterday's Revolut outage after a Google Cloud power failure showed the same thing from another side. Build a short list of your critical vendors into your back-office stack, and keep it next to your password manager.

Are you getting customers from ChatGPT yet?

More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.

👉 Rank on ChatGPT

What happens next?

PHP has published the release and the full advisory, and hosts are rolling out the fix: cPanel's EasyApache 4 and CloudLinux shipped patched builds on 21 and 22 October, Hostinger finished its hosting servers except VPS, and AWS updated Elastic Beanstalk and Amazon Linux. Next, watch for three things: a working public exploit, CISA adding the CVEs to its Known Exploited Vulnerabilities list, and the first confirmed break-in. We will update this article when any of them happens.

Not every founder runs their own server. If you have one small business website and no developer, follow the Fe/male Switch Foundation's no-developer plan for small business websites. If you build or look after sites for clients, femaleswitch.com has a 24-hour plan for freelancers with a message you can send them. Engineering teams whose portals and download pages hold CAD files can follow CADChain's PHP checklist for engineering teams.

For the bigger picture, we track security incidents every month in our cybersecurity news for October 2026, and WordPress-specific updates in our WordPress news for October 2026. A secure site is also part of trust: here are 5 website features that make customers trust your business faster.

FAQ: the critical PHP vulnerability

What is the PHP vulnerability of October 2026?

PHP announced two critical security flaws on 20 October 2026, both rated CVSS v4.0 9.2, and fixed them on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are CVE-2026-109618 and CVE-2026-109619, and both allow unauthenticated remote code execution.

Which PHP version fixes the vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official release, only minimal source backports for 7.4, 8.0 and 8.1.

Which PHP versions are affected?

Every version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to PHP's advisory, on every setup that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers say the bugs reach back to PHP 5.

Is WordPress affected by the PHP vulnerability?

WordPress runs on PHP, so WordPress sites depend on the PHP version installed on their server. Updating WordPress itself won't fix it. Your host or server admin needs to install the fixed PHP release.

How do I check my PHP version?

Look in your hosting control panel under PHP settings, check Tools and then Site Health in the WordPress admin, or run php -v on the server.

Is the PHP vulnerability being exploited?

Attempts, yes. Amazon saw a first attempt on 17 October and calls php2shell broadly exploited, and watchTowr and Cloudflare report attack traffic. No successful break-in has been confirmed: CISA had not observed exploitation on 21 October, and NCSC-NL found on 22 October that none of the public exploits it tested worked. Patch today either way.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.

Violetta Bonenkamp

2026-10-21 13:25 News and Trends