What happened
On 21 October 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow remote code execution without a login and carry a CVSS v4.0 score of 9.2. According to PHP, all installations serving web requests are affected, including PHP-FPM, Apache mod_php and php-cgi. The fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP 8.1 and older are no longer supported upstream. A fix then depends on your Linux distribution, an LTS vendor or a self-built backport. That affects many organisations: according to W3Techs, 34.7% of websites using PHP still run version 7 or older. Now that the technical details are public, exploitation attempts are a realistic risk.
Patching is step one. Three questions remain
- What if you cannot update right away? Legacy code, supplier dependencies or unsupported PHP versions don’t get resolved overnight.
- Were you already compromised before you patched? A patch closes the door; it does not remove an intruder.
- How do you avoid the next scramble? This will not be the last critical flaw in your web stack.
Our answer on one page
Our advisory sets out which PHP versions are affected, why older versions carry extra risk and how to respond in three steps: shield, verify and fix. You will also find out whether your organisation needs to act now.
Also read –> ‘Why a well tuned WAF matters‘
Download the pdf here
We have summarised everything on one page: what happened, the three open questions and our approach.
Prefer to talk straight away? Book a short call to map your PHP exposure: sales@approach-cyber.com or +32 15 50 44 00.