PHP critical flaws: emergency patch due today, older servers left exposed
Representative image: Bru-nO / Pixabay
PHP's security team will patch two critical remote code execution flaws on October 21, 2026, at 14:00 UTC; servers on PHP 8.1 or older will not get an official fix.
What Happened
The PHP security team has warned website and server administrators of two critical flaws in PHP, the programming language that runs a large share of the world's websites, and scheduled an emergency security release for Wednesday, October 21, 2026, at 14:00 UTC (7:30 pm India time). The flaws, numbered CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 for severity by the PHP team. Security researchers say they allow remote code execution, meaning an attacker could run their own commands on an affected server over the internet.
Key Facts
- The flaws: CVE-2026-109618 and CVE-2026-109619, two remote code execution vulnerabilities in the core of PHP. CVE numbers are the standard public IDs given to security flaws.
- Severity: 9.2 on the CVSS 4.0 scale according to the PHP team; some third-party reports cite 10.0, but the official rating is 9.2.
- Patch timing: an out-of-band (unscheduled) release on October 21, 2026, at 14:00 UTC; the team said it may release earlier if technical details spread or attacks begin.
- Early leak: details surfaced ahead of the planned disclosure, and security firm Sansec reported that a screenshot of an attack tool linked to the flaws had circulated.
- Who gets fixes: only PHP versions that are still supported, 8.2 and later, according to Sansec. Servers on PHP 8.1 or older will not receive an official patch.
- Exploitation: as of the morning of October 21, there was no confirmed report of the flaws being used in attacks, but security firms expect attempts soon after the release.
Why It Matters
PHP sits underneath a very large number of business websites: online shops, company sites, booking systems, blogs and many content-management systems. A flaw in PHP itself, rather than in one website's code, means a single weakness can affect huge numbers of servers at once. Remote code execution is the most serious kind of software flaw, because an attacker who succeeds can take control of the server, steal customer data, plant malware or use it to attack others.
The timing makes this urgent for businesses. Because details leaked before the fix was ready, attackers may already be studying the flaws. Security firms warn that once a patch is published, criminals compare the old and new code to work out how to exploit the flaw, so the window between release and attacks can be hours rather than weeks.
The bigger risk is old software. Many small and mid-sized businesses, including in India, run websites on hosting plans or servers that have not been upgraded for years. PHP 8.1 and earlier versions are no longer supported, so they will not get an official fix. Sansec, which specialises in e-commerce security, notes that the problem must be fixed at the server level: a website owner cannot patch it by changing the store's own code. That makes the hosting provider or IT team the key actor.
For India's digital economy, where lakhs of MSMEs now sell online or take bookings through their own websites, the episode is a reminder that software maintenance is a business cost, not an optional extra. A breach can mean lost sales, payment fraud and obligations under India's data protection rules if customer personal data is exposed.
Impact
Short-term: IT teams and hosting companies will need to install the new PHP versions as soon as they are released on October 21, and to check every server, including forgotten test sites. Businesses on shared hosting should confirm with their provider that the update has been applied.
Long-term: Companies still running PHP 8.1 or older face a choice between upgrading to a supported version, paying for a provider's own back-ported fix, or accepting a serious and lasting risk. The incident is likely to push more firms to keep a list of their software versions and plan regular upgrades.
Who is affected: Businesses of every size that run websites or web applications on PHP; hosting and cloud providers; e-commerce stores; IT service firms that manage client servers; and customers whose data sits on those servers.
Key Takeaway
An emergency PHP fix for two critical remote code execution flaws is due at 7:30 pm IST on October 21, 2026, and businesses should update at once and move off unsupported PHP 8.1 or older.
Questions and Answers
What are the PHP critical flaws announced in October 2026?
They are two remote code execution vulnerabilities in the core of PHP, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 by the PHP team. They could let an attacker run commands on an affected web server over the internet.
When will the PHP emergency patch be released?
The PHP team scheduled the security release for October 21, 2026, at 14:00 UTC, which is 7:30 pm in India, and said it could come earlier if attacks begin.
Will older PHP versions get a fix?
According to security firm Sansec, only supported versions, PHP 8.2 and later, will get official patches. Sites on PHP 8.1 or older need to upgrade or rely on a hosting provider's own fix.
What should a small business with a PHP website do?
Ask the hosting provider or IT team to apply the new PHP release as soon as it is out, confirm which PHP version the site runs, and plan an upgrade if it is 8.1 or older. The fix has to be made on the server, not in the website's own code.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Intuitive Surgical beats Q3 estimates but shares fall on pricing
Japan's September exports rise 16.7% on chip demand, miss forecasts
Reported, fact-checked and published by the Peepals Global Editorial Team.
