Critical PHP flaws prompt urgent patch warning
The vulnerabilities could allow unauthenticated attackers to run code on affected servers, security officials say.
The PHP development team has released fixes for two critical vulnerabilities that could allow unauthenticated remote code execution. The UK’s National Cyber Security Centre urged organisations to update promptly and consider taking systems offline if they cannot apply the fix or temporary mitigations.
PHP is a programming language used by a large number of websites and web applications. The PHP team said the new release fixes two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which could allow an attacker to execute code without first authenticating.
The team rated both vulnerabilities 9.2 under the CVSS v4.0 scoring system. That score indicates a serious technical risk, but it does not by itself show how many systems are exposed or whether a particular organisation has been attacked.
The PHP team said the fixed release was available immediately and strongly encouraged users to update. It said there were no complete mitigations for the affected versions, making patching the central response.
The NCSC advised organisations to update to the latest PHP version and apply additional hardening measures provided by the PHP team. Where updating was not possible, it pointed to temporary mitigations; where those could not be applied promptly, it said organisations should consider taking the system offline until it was protected.
The warning has practical consequences for website operators, hosting companies and public bodies. Taking systems offline may prevent exploitation but can also interrupt services while administrators assess their exposure.
PHP 8.2 users face an additional deadline: the PHP project says that branch will reach end-of-life on 31 December 2026 and will then receive no further security fixes. Organisations using that branch therefore face both an immediate patching task and a longer-term upgrade decision.
Neither the PHP team nor the NCSC has confirmed widespread exploitation in its public notices. The extent of any exploitation or resulting disruption remains unclear.
Also show where in Europe and in the world
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article relies on the PHP project and the UK NCSC for the technical and response claims. It avoids asserting widespread exploitation or attributing every reported outage to PHP.
- confirmed The PHP release fixes two critical vulnerabilities allowing possible unauthenticated remote code execution. — Confirmed by the PHP project’s release notice. source
- confirmed The vulnerabilities were rated CVSS v4.0 9.2. — Confirmed in the PHP security announcement. source
- confirmed The NCSC advises organisations to consider taking systems offline if they cannot mitigate the issue. — Confirmed by the NCSC alert. source
Editor's note
The vulnerabilities, severity score, fixed release and NCSC guidance are confirmed. The scale of any outage or exploitation is not established by the sources and is explicitly left uncertain.Sources
- PHP 8.2.35 Released — PHP
- Critical security issue affecting PHP — National Cyber Security Centre
- Today’s PHP Security Release — PHP Foundation
More on this in other media
- iNews — „php cyber security”
- BBC News — „php cyber security”
- The Guardian — „php cyber security”