PHP critical vulnerabilities: security fixes are available
The official guidance concerns administrators of websites and services using PHP. The NCSC urges organisations to identify and update their systems.
Two critical PHP vulnerabilities can, under certain conditions, allow commands to run on a server without authentication. The PHP team released fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026.
Fixed versions
The corrected releases for the respective branches are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of Linux-distribution packages or long-term-support services should check their vendor’s update: fixes may be backported into packages with older version numbers.
What website administrators should check
The UK’s National Cyber Security Centre (NCSC) urges organisations to identify all PHP installations, prioritise internet-facing systems and apply updates. Temporary mitigations reduce particular risks but do not replace the fixes.
If updates or temporary mitigation cannot be applied promptly, the NCSC advises considering taking the system offline. Website owners can ask their administrator or hosting provider to confirm that the security fixes have been installed.
English translation of the Greek edition · Read in Greek