{"id":3563,"date":"2026-10-22T23:00:26","date_gmt":"2026-10-22T23:00:26","guid":{"rendered":"https:\/\/acatechsolutions.co.uk\/blog\/?p=3563"},"modified":"2026-10-22T23:00:26","modified_gmt":"2026-10-22T23:00:26","slug":"critical-php-vulnerabilities-update-immediately","status":"publish","type":"post","link":"https:\/\/acatechsolutions.co.uk\/blog\/critical-php-vulnerabilities-update-immediately\/","title":{"rendered":"Critical PHP Vulnerabilities Affect Websites Worldwide: Update Immediately"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Security advisory \u2014 22 October 2026:<\/strong> This is an actively developing situation. PHP users should follow the PHP project and their operating-system or hosting provider for the latest package-specific guidance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two critical PHP vulnerabilities have been identified in the server-side programming language used by a large share of websites and web applications worldwide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The flaws can allow <strong>unauthenticated remote code execution<\/strong>. In practical terms, a vulnerable internet-facing server may be exposed to an attacker without the attacker first needing a valid username or password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP project has released corrected versions and is urging users to update immediately. Government cyber-security agencies have issued similar guidance. Some public and private organisations have temporarily taken services offline while their teams apply and verify the fixes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is not limited to one country, one hosting company or one content-management system. Businesses operating WordPress, WooCommerce, Magento, PrestaShop, custom PHP applications and products that bundle PHP should review their exposure now.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP project disclosed two critical vulnerabilities:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618:<\/strong> an out-of-memory handling flaw that can leave internal request data partially initialised and create a route to remote code execution.<\/li>\n\n\n\n<li><strong>CVE-2026-109619:<\/strong> a stale global-state flaw in which request-owned internal state may survive after its backing memory has been released.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Both issues are serious because they affect the PHP runtime itself rather than a single website plugin or theme. The PHP advisory states that installations serving web requests may be affected, including PHP-FPM, Apache <code>mod_php<\/code>, <code>php-cgi<\/code>, FrankenPHP and LiteSpeed environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The risk is considered particularly high for <code>mod_php<\/code>, where an unauthenticated request may reach the vulnerable path before application code runs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which PHP versions contain the fixes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP project released the following corrected versions on 21 October 2026:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>PHP branch<\/th><th>Fixed release<\/th><\/tr><\/thead><tbody><tr><td>PHP 8.5<\/td><td><strong>8.5.12<\/strong><\/td><\/tr><tr><td>PHP 8.4<\/td><td><strong>8.4.27<\/strong><\/td><\/tr><tr><td>PHP 8.3<\/td><td><strong>8.3.36<\/strong><\/td><\/tr><tr><td>PHP 8.2<\/td><td><strong>8.2.35<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If your server uses a package supplied by a Linux distribution, managed hosting provider or long-term-support vendor, the fixed package number may differ because vendors sometimes backport security patches without changing to the version number shown above. Confirm the exact remediation with that vendor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PHP 8.1 and older no longer receive normal security releases from the PHP project. Some vendors may provide backported fixes, but an unsupported installation should not be assumed safe simply because the server reports that no routine update is available.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who needs to act?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You should investigate immediately if your organisation operates or depends upon:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress or WooCommerce websites<\/li>\n\n\n\n<li>Magento or Adobe Commerce stores<\/li>\n\n\n\n<li>PrestaShop installations<\/li>\n\n\n\n<li>Drupal, Joomla or other PHP-based platforms<\/li>\n\n\n\n<li>Laravel, Symfony or custom PHP applications<\/li>\n\n\n\n<li>Control panels, appliances or business applications that bundle PHP<\/li>\n\n\n\n<li>Shared, virtual or dedicated hosting running PHP websites<\/li>\n\n\n\n<li>Development, staging, administrative or legacy systems exposed to the internet<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not check only the public website. Forgotten staging sites, old subdomains, control panels and internal tools exposed through a public address can create the same kind of risk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What should businesses do now?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"427\" src=\"https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process-1024x427.webp\" alt=\"Three-stage response to a critical PHP vulnerability: exposed systems, temporary isolation, then verified patching\" class=\"wp-image-3565\" srcset=\"https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process-1024x427.webp 1024w, https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process-300x125.webp 300w, https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process-768x320.webp 768w, https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process-1536x640.webp 1536w, https:\/\/acatechsolutions.co.uk\/blog\/wp-content\/uploads\/2026\/10\/php-patching-response-process.webp 1800w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">A practical response flow: assess exposure, isolate if necessary, then patch and verify.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">1. Identify every PHP system<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create an inventory of internet-facing websites, applications, APIs, administrative interfaces and appliances that use PHP. Record the active PHP version, execution model, operating system, hosting provider and business owner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a server you administer, <code>php -v<\/code> can report the command-line version, but that may not be the same version used by the web server. Verify the PHP handler attached to each website through its hosting panel or web-server configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Take a verified backup<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before making a runtime change, create a current backup of the application files, configuration and database. Confirm where it is stored and that the recovery process is understood. A backup that has never been tested should not be treated as a complete recovery plan.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Apply the appropriate security update<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use the package supplied by PHP, your operating-system vendor or your hosting provider. Do not download replacement binaries from an unverified third-party website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Updating WordPress, Magento or another application does <strong>not<\/strong> update the underlying PHP runtime. These are separate maintenance tasks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Restart affected workers and services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After patching, restart the relevant PHP workers and web services so that old processes are no longer holding vulnerable code in memory. The exact process depends on whether the server uses PHP-FPM, Apache, LiteSpeed, containers or another deployment model.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Verify the live runtime<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that the web-facing application is actually using the corrected package. Test important customer journeys such as authentication, forms, checkout, payment callbacks, scheduled jobs and administrative functions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Review for suspicious activity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Examine web-server, proxy, WAF, application and authentication logs covering the period before and after patching. Look for unexplained requests, newly created files or users, unusual outbound connections, modified scheduled tasks, unexpected administrative activity and other indicators that do not match normal operation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Patching closes the vulnerability; it does not prove that a previously exposed system was never accessed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What if you cannot patch immediately?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The UK National Cyber Security Centre advises organisations to consider taking affected systems offline when immediate remediation is not feasible. Other national and regional cyber-security bodies have issued comparable advice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The PHP project has published temporary mitigations for particular attack paths, but it is explicit that <strong>only an update is a complete solution<\/strong>. Temporary configuration changes should therefore be treated as short-lived risk reduction, not as a substitute for patching.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a business-critical service that cannot be updated safely, involve the hosting provider or a qualified administrator. The decision should account for the sensitivity of the data, internet exposure, available compensating controls and the consequences of taking the service offline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Were the affected websites hacked?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Not necessarily. Several organisations took websites or individual services offline as a precaution while patches were applied. A precautionary shutdown should not be described as a confirmed compromise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the absence of a public breach announcement is not evidence that every exposed installation is safe. Each organisation must assess its own infrastructure, logs and security controls.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this incident matters beyond PHP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerabilities were uncovered with assistance from advanced AI systems and disclosed through a coordinated process involving researchers, PHP maintainers, infrastructure providers and government agencies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That coordination gave defenders time to prepare fixes, but it also illustrates how quickly vulnerability research is changing. Organisations need an accurate technology inventory, reliable patching procedures, tested recovery plans and monitoring that can identify unusual activity without depending on someone remembering to check a crowded inbox.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How ACA Tech Solutions can help<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ACA Tech Solutions supports organisations internationally with website, server and managed IT operations. We can help you:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>identify websites and applications using affected PHP versions;<\/li>\n\n\n\n<li>confirm the correct vendor or hosting-provider update;<\/li>\n\n\n\n<li>create and verify backups before remediation;<\/li>\n\n\n\n<li>coordinate PHP upgrades and application compatibility testing;<\/li>\n\n\n\n<li>verify that web workers were restarted onto the fixed runtime;<\/li>\n\n\n\n<li>review relevant logs and investigate suspicious changes; and<\/li>\n\n\n\n<li>establish ongoing vulnerability monitoring and maintenance.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure which PHP version your website is actually running, or whether your provider has applied a backported fix, <a href=\"https:\/\/acatechsolutions.co.uk\/contact\/\">contact ACA Tech Solutions<\/a> before making an untested production change.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is this only a WordPress vulnerability?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. The vulnerabilities are in PHP itself. WordPress is one of many platforms that use PHP.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is updating plugins and themes enough?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. Plugins, themes, the main application and the PHP runtime are separate components. The PHP package must receive the relevant fix.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does a firewall or CDN completely remove the risk?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A WAF, CDN or hosting-provider rule may reduce exposure to known request patterns, but it should not be treated as a replacement for the corrected PHP runtime.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Should every PHP website be taken offline?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Systems that can be patched promptly should be updated and verified. Taking a system offline is a risk-management option when timely remediation is not possible, not an automatic requirement for every installation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Where can I find authoritative guidance?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the <a href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noopener\">PHP project\u2019s security advisory<\/a> and the <a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" target=\"_blank\" rel=\"noopener\">UK National Cyber Security Centre alert<\/a>. Organisations should also consult their national cyber-security authority, operating-system vendor and hosting provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article provides general security information and does not replace an assessment of your specific systems. Guidance may change as vendors publish further updates.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Two critical PHP vulnerabilities can allow unauthenticated remote code execution. Learn which versions are fixed and what website owners should do now.<\/p>\n","protected":false},"author":1,"featured_media":3564,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17,23],"tags":[25,28,24,29,27,26],"class_list":["post-3563","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-information_technology","category-cyber_hygiene","tag-cybersecurity","tag-magento-security","tag-php","tag-vulnerability-management","tag-website-security","tag-wordpress-security"],"_links":{"self":[{"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/3563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=3563"}],"version-history":[{"count":1,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/3563\/revisions"}],"predecessor-version":[{"id":3566,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/posts\/3563\/revisions\/3566"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/media\/3564"}],"wp:attachment":[{"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=3563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=3563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acatechsolutions.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=3563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}