Organisations using the PHP programming language face an urgent choice: install a critical security update or take their systems offline. According to BBC News, two serious vulnerabilities in PHP have prompted cyber authorities across multiple countries to issue emergency guidance.
The PHP Foundation is releasing patches on 21 October 2026 at 14:00 UTC to address the flaws, identified as CVE-2026-109618 and CVE-2026-109619, both carrying CVSS v4.0 scores of 9.2. The UK's National Cyber Security Centre (NCSC), alongside cyber-security agencies in the European Union and Australia, have urged organisations to apply the fixes immediately upon release.
The NCSC stated in its advisory that
where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. EU cyber-security officials issued comparable guidance, emphasising the severity of the threat.
Why is PHP so critical?
PHP powers a substantial portion of the global internet infrastructure. The programming language runs on servers to generate the content users see when visiting websites, and it is embedded in many platforms without being explicitly advertised. Cybersecurity firm Huntress noted that
PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood.
The European Union Computer Emergency Response Team (CERT-EU) warned that the risk scores assigned to these vulnerabilities
indicate the potential for unauthenticated remote code execution. Such attacks could allow malicious actors to install malware, compromise data, and disable websites entirely.
What are the technical details?
The vulnerabilities potentially affect all PHP versions from PHP 5 onwards, which was released in 2004. A VirusTotal analysis indicated that the flaws relate to PHP's `session.upload_progress` feature, introduced in PHP 5.4.0 and enabled by default. As an interim protective measure before the official patch becomes available, organisations can disable `session.upload_progress.enabled` in their `php.ini` configuration file.
Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, reported that
seeing early attacks emerging and are updating mitigations as new vectors show up. However, Australia's cyber-security centre said it was not aware of active exploitation at the time of its advisory.
What should organisations do now?
The NCSC advised that once organisations have installed the update, they should
continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. This guidance reflects the reality that many software packages and services incorporate PHP without users realising it, creating multiple potential exposure points.
The PHP security team reserved the option to release the fixes earlier if vulnerability details became public or evidence of active exploitation emerged before the scheduled release date.
When will patches be available?
The PHP Foundation scheduled the security release for 21 October 2026 at 14:00 UTC, with full technical details, affected versions and fixed versions to be published at that time. Australia's advisory gave the public disclosure time as 22 October 2026 at 01:00 AEDT, providing a window for organisations to apply patches before full technical information becomes widely available.
Key Facts:
- Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) carry maximum severity scores of 9.2
- Cyber authorities in the UK, EU and Australia have urged immediate patching or system shutdown
- PHP powers WordPress, Drupal, Joomla, Magento and countless other platforms globally
- Organisations can temporarily disable the `session.upload_progress` feature as an interim mitigation
- Official patches release on 21 October 2026 at 14:00 UTC
