Skip to content
Critical PHP Vulnerabilities Require Immediate Updates

Critical PHP Vulnerabilities Require Immediate Updates

First seen 21 Oct 2026, 21:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 22:11 UTC
  • •Two critical vulnerabilities in PHP allow unauthenticated remote code execution.
  • •All PHP users are urged to update to patched versions immediately.
  • •PHP 8.2 will reach end of life on December 31, 2026.

On October 21, 2026, the PHP project released security updates for critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. These vulnerabilities allow unauthenticated remote code execution, posing a significant risk to all PHP installations, including web servers and internal applications. The National Cyber Security Centre (NCSC) and Wordfence have urged all PHP users to update to the patched versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.2 will reach end of life on December 31, 2026, and will no longer receive security fixes. Users are advised to check their PHP versions and update immediately, as the vulnerabilities can be exploited without authentication.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP vulnerabilities disclosed
CVE-2026-109618 and CVE-2026-109619 are published, allowing unauthenticated remote code execution.
Wordfence
2026-10-21
Security updates released
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are released to fix the vulnerabilities.
Bacs.Admin.Ch
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which PHP versions are affected?
All PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are affected.
What should I do if I can't update immediately?
Restrict access to affected applications and consider taking them offline if necessary.
How can I verify my PHP version?
Check your PHP version in the WordPress dashboard under Tools > Site Health > Info tab.