PHP patches two critical bugs today; 8.1 and older get no fix
PHP ships fixes for two remote code execution flaws at 14:00 UTC. Sites on PHP 8.2 or newer can patch; older ones need a host's backport or an upgrade.
The short read
PHP fixes two critical flaws at 14:00 UTC today, but about a third of PHP sites run unsupported versions.
- Both bugs are rated 9.2 of 10 and may allow remote code execution. Details leaked on Tuesday, before the planned release.
What you can do with this
Run php -v on every server, or ask your host which PHP version your sites use. If it is 8.2 or newer, book the update for 14:00 UTC; if older, ask for a backport today.
The PHP project will release fixes for two critical vulnerabilities today, Wednesday, October 21, at 14:00 UTC (10:00 in New York, 16:00 in Central Europe). PHP’s own notice rates both CVSS v4.0 9.2 and asks every PHP user to “prepare now.” If your company runs a site on WordPress or Magento, this is your update.
The catch is which versions get it. PHP only supports 8.2 and newer. And details leaked before the release, so attackers may move before many sites patch.
What PHP has said, and what leaked
PHP’s security team posted the notice on Tuesday at 19:33 UTC, signed by Jakub Zelenka on the php.announce list. It says “full details, affected versions, and the fixed versions will be published with the release,” and that PHP may release earlier if details go public or attacks start.
They already went public in part. A Hacker News post at 15:20 UTC on Tuesday claimed two PHP remote code execution flaws were coming, citing an unnamed source. The EU’s computer emergency team, CERT-EU, lists them as CVE-2026-109618 and CVE-2026-109619 and says a 9.2 score suggests unauthenticated remote code execution. Sansec, a store security firm, reports that a screenshot of an exploit tool called PHP2Shell leaked and that watchTowr, another security firm, confirmed the bugs.
Two claims stay unconfirmed. CERT-EU says the flaws “could affect all PHP versions from PHP 5 onwards,” but flags that this comes from social media. Sansec expects mass attacks within 15 minutes of the release; that is a forecast, not an observation.
Why older PHP is the real exposure
PHP gives each version a fixed support window: 8.2 gets security fixes until December 31, 2026, and 8.5 until the end of 2029. Anything older than 8.2 gets nothing from the project. Sansec’s advice for servers on 8.1 or older is to ask the host to backport the fix or move to a supported version.
That is not a small group. W3Techs counted PHP on 69.3% of websites whose server language it can see, as of today. Of those PHP sites, 27.0% run version 7 and 7.7% version 5, with a further 0.1% on version 4.
By our arithmetic that is 34.8%, about one PHP site in three, on versions with no official fix. The real share is higher, because PHP 8.0 and 8.1 are also out of support and W3Techs does not split version 8.
The stopgap people are using, and its limit
Reports gathered by lilting.ch place at least one bug in PHP’s upload progress feature; PHP has not confirmed this. The feature is on by default: the PHP source sets session.upload_progress.enabled to 1. Turning it off stops only progress tracking for file uploads, according to the same report, and uploads still work.
It is partial cover at best. A researcher quoted in the report says the switch blocks only one of the two bugs.
The setting cannot be changed from inside a script. PHP’s manual says settings of this kind are set in php.ini, .htaccess, httpd.conf or .user.ini.
What to do now
- Find every PHP site you own or pay for. Run
php -von servers you manage. For hosted sites, ask the host which version runs and when it will apply today’s fix. - On 8.2 to 8.5, plan the update for 14:00 UTC. The current releases are 8.5.11, 8.4.26, 8.3.35 and 8.2.34; PHP will name the fixed ones at release time.
- On 8.1 or older, ask the host for a backport today, or start the move to 8.2 or newer. Note that 8.2 support ends on December 31.
- Until you patch, set
session.upload_progress.enabled = Offin php.ini or .user.ini if your site has no upload progress bar, and reload PHP. Treat it as partial cover. - If you cannot patch a public site soon, CERT-EU suggests isolating it from the internet until you can. That is costly for a shop, so weigh it against how much the site holds.
Sources
- PHP, “Upcoming Critical PHP Security Release,” news archive, October 20, 2026: https://www.php.net/archive/2026.php#2026-10-20-1
- php.announce #509, Jakub Zelenka, October 20, 2026: https://news-web.php.net/php.announce/509
- CERT-EU, Security Advisory 2026-018, “Critical Vulnerabilities in PHP”: https://cert.europa.eu/publications/security-advisories/2026-018/
- Sansec, “Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619,” October 21, 2026: https://sansec.io/research/php2shell
- Hacker News, “Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming,” October 20, 2026: https://news.ycombinator.com/item?id=50167754
- PHP, supported versions: https://www.php.net/supported-versions.php
- W3Techs, usage statistics of PHP, October 21, 2026: https://w3techs.com/technologies/details/pl-php
- lilting.ch, “Disabling session.upload_progress Before the php2shell Patch Lands”: https://lilting.ch/en/articles/php2shell-session-upload-progress-uaf
- PHP source, ext/session/session.c: https://github.com/php/php-src/blob/master/ext/session/session.c
- PHP manual, INI mode constants: https://www.php.net/manual/en/configuration.changes.modes.php
