The PHP development team released emergency security updates Wednesday, October 21, to address two critical vulnerabilities that could allow attackers to execute code remotely on web servers without authentication. The releases follow reports of attempted exploitation and prompted an urgent warning from the UK’s National Cyber Security Centre (NCSC).

Four patched versions are now available: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP security advisory, the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP installations serving web requests, including deployments using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Both flaws carry a critical severity rating of 9.2 under CVSS 4.0.

The vulnerabilities involve memory-management failures within PHP itself, rather than defects in individual web applications. One concerns corrupted internal request data following an out-of-memory condition; the other involves request state remaining accessible after its underlying memory has been freed. Under certain conditions, either flaw can lead to unauthenticated remote code execution.

Attack activity has been reported, but confirmed compromises remain unestablished. Security company Patchstack said hosting partners had reported active exploitation incidents earlier Wednesday. Cloudflare also reported observing early attacks and deploying initial web application firewall protections. However, Patchstack said its telemetry showed probing activity without hard evidence of successful breaches as of 13:57 UTC.

The exposure extends across widely used hosting environments. PHP supports major content management systems and web applications, including WordPress, Drupal, Joomla and Magento. Because the vulnerabilities reside in the PHP interpreter, application-level security measures alone cannot eliminate the underlying risk. The PHP team identifies Apache mod_php as particularly exposed, citing a demonstrated attack that can be triggered before application code executes.

The NCSC’s October 21 alert urges organizations to identify PHP installations across their infrastructure, prioritize internet-facing systems and apply vendor updates. The agency also warns that PHP may be embedded in third-party products and appliances, potentially complicating vulnerability inventories and remediation.

Older PHP installations present an additional challenge. PHP 8.1 and earlier versions no longer receive regular upstream security releases. Some Linux distributions and long-term-support vendors may provide backported fixes, while the PHP security team has published limited source patches for versions 7.4, 8.0 and 8.1.

The PHP team says configuration changes can reduce exposure to specific attack methods but cannot fully eliminate the vulnerabilities. Operators unable to patch immediately may need temporary mitigations or service restrictions, according to the NCSC.

The immediate question for hosting providers and infrastructure operators is how quickly patched PHP packages can be deployed across shared hosting fleets, managed platforms and other internet-facing services. The availability of upstream fixes does not establish that those fixes have reached every affected installation.