Critical PHP Vulnerabilities: How to Protect Your Website from Remote Code Execution

If your website, online store, or business application runs on PHP, this is one security update you cannot afford to postpone. In October, the PHP project released emergency security updates for two critical vulnerabilities in the PHP core itself. Security agencies around the world, including CISA in the United States, urged organizations to patch immediately.
PHP powers a very large share of the web, including popular platforms such as WordPress, Drupal, Joomla, and Magento, as well as countless custom business applications. That is why this issue matters to almost every company with a website. In this article, we explain what happened, who is at risk, and the exact steps to protect your business.

What Happened?

On October 21, the PHP developers released emergency fixes for two critical flaws in the PHP core interpreter, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS v4.0 scale, which places them in the critical category.

In simple terms, these flaws can allow an attacker to run their own code on your web server. This is called remote code execution (RCE), and it is one of the most dangerous types of security problems.

Two details make the situation especially serious:

• No login is needed: An attacker does not need a username or password. A specially crafted request sent to a vulnerable server can be enough to trigger the problem.
• It happens before your application code runs: Because the weakness sits inside the PHP engine itself, your own website code, firewall rules inside the application, or security plugins may not stop it.

A further remote code execution issue was also reported shortly afterward, so it is wise to follow the official PHP security announcements for the latest information.

What Is Remote Code Execution and Why Is It So Dangerous?

Remote code execution means a stranger on the internet can make your server run commands of their choice. If that happens, an attacker may be able to:

• Steal customer data, passwords, and business information.
• Install malware, backdoors, or ransomware.
• Deface your website or redirect visitors to harmful pages.
• Use your server to send spam or attack other websites.
• Take full control of the server and everything hosted on it.

For a business, the results can include lost revenue, legal and compliance problems, damaged reputation, and expensive recovery work.

Who Is at Risk?

The PHP project has stated that every PHP installation serving web requests can be affected. This includes common setups such as:

• Apache with mod_php
• PHP-FPM
• php-cgi
• FrankenPHP
• LiteSpeed

Of these, the PHP team considers mod_php to carry the highest risk.

In practical terms, you may be affected if you have:

• A WordPress, Drupal, Joomla, Magento, or Laravel website.
• A custom PHP application, customer portal, or internal tool.
• A shared hosting, VPS, or dedicated server running PHP.
• Third-party products that quietly include PHP inside them.

Which PHP Versions Are Fixed?

The emergency updates are available in the following releases:

PHP branch	Fixed version
PHP 8.5	8.5.12 or later
PHP 8.4	8.4.27 or later
PHP 8.3	8.3.36 or late
PHP 8.2	8.2.35 or later

If your site still runs an outdated version such as PHP 5.x or 7.x with no vendor support, the safest path is to upgrade to a supported version as soon as possible.

A Common Misunderstanding: Updating WordPress Is Not Enough

Many website owners assume that clicking “Update” in WordPress or updating their plugins solves the problem. It does not.

The vulnerabilities exist in the PHP runtime that runs on the server, not in WordPress, your theme, or your plugins. Fixing them requires updating the PHP software itself, which usually means:

• Asking your hosting provider to confirm that PHP has been updated.
• Using your hosting control panel to switch to a patched PHP version.
• Having your server administrator or IT partner update PHP on your VPS or dedicated server.

Keeping your CMS and plugins updated is still important, but it is a separate task.

Why Attackers Move So Fast Now

Security researchers warn that the time between a vulnerability becoming public and attackers using it has become very short. Automated tools and AI make it easier to scan the internet for vulnerable servers within hours. This is why waiting for the next scheduled maintenance window is risky.

The lesson is clear: when a critical, unauthenticated vulnerability is announced in software that faces the internet, patching is an emergency task, not a routine one.

What Should You Do Right Now? A Step-by-Step Checklist

1. Find out which PHP version you use. Ask your developer or hosting provider, or check your hosting control panel. Create a list of every website and application that runs on PHP.
2. Check your hosting situation. If you are on shared or managed hosting, contact your provider and confirm they have applied the PHP security update. If you manage your own server, you are responsible for updating it.
3. Update PHP to a fixed version. Move to 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a newer release. If you install PHP through your operating system’s package manager, apply the updated packages released by your vendor.
4. Replace unsupported versions. If you run PHP 8.1 or older, plan an upgrade to a supported version. Use vendor-backed long-term support or the official backports only as a temporary measure.
5. Test your website after the update. Check your forms, checkout, login, and key features. Older plugins, themes, or custom code may need small fixes to work with newer PHP versions.
6. Restart services. After updating, make sure the web server and PHP services are restarted so the new version is actually in use.
7. Check for signs of compromise. Review server logs for unusual requests, look for unknown files or new admin accounts, and scan your site for malware. If you suspect an attack, treat the server as compromised and get professional help.
8. Keep backups ready. Make sure you have recent, clean backups stored separately from your server so you can recover quickly if needed.
9. Add extra protection layers. A web application firewall, network monitoring, and strict server permissions can add another barrier, but remember they are a supplement and never a replacement for installing the patch.

Check Your Third-Party Software Too

Some products bundle their own copy of PHP, such as control panels, ecommerce platforms, and appliance software. Updating the PHP version on your server may not update the one inside these products. Check with each vendor for a security update, and ask your IT team to include them in your inventory.

Long-Term Lessons for Your Business

This incident is a good reminder to improve your general security habits:

• Maintain an inventory. Know every website, application, and server you run, and which software versions they use.
• Never run end-of-life software. Outdated PHP versions are a risk even without a headline vulnerability.
• Plan regular updates. Schedule routine patching and have a fast process for emergencies.
• Monitor continuously. Early warning of unusual activity can limit damage.
• Work with a reliable IT partner. Experts can handle updates, testing, and monitoring so your team can focus on the business.

Preventing problems is almost always cheaper and easier than cleaning up after a breach.

Conclusion

The critical PHP vulnerabilities announced in October are a serious wake-up call for every business that runs a PHP-based website or application. They allow remote code execution without a login, they affect the PHP engine itself, and updating your CMS or plugins alone does not fix them. The only complete solution is to update PHP to a patched version and, where needed, move away from unsupported versions.

Check your PHP version today, confirm with your hosting provider, and act without delay.

Not sure whether your website is safe? Contact our team for a quick PHP security check. We will review your servers, update your PHP environment, test your applications, and help you stay protected.