The PHP project shipped emergency security releases today for two flaws that can let an attacker run code on a web server without logging in. PHP rates both 9.2 out of 10. Code claiming to exploit them is already circulating, and at least two security companies say attacks have started.
This is not a WordPress plugin or a Drupal module. It is the language both of them run on. Updating your CMS does nothing here, which is why this one needs a different conversation than the last four security posts we published.
Where this comes from. The PHP project's own advisory and release announcements, and the two GitHub security advisories it links, all read directly. Claims about attacks are attributed to the companies that made them.
What Happened
On October 20 the PHP project announced a critical security release for October 21 at 14:00 UTC, and said it reserved the right to release earlier if details became public. Details did start circulating that day. The fixes shipped on the 21st.
- The fixed versions. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your server is on an earlier patch release of any of those branches, it is affected.
- The first flaw. CVE-2026-109618. When PHP runs out of memory partway through starting a request, internal data can be left half-built, and the cleanup step can then treat it as valid. That opening leads to code execution.
- The second flaw. CVE-2026-109619. Data that belonged to one request can survive after it is freed and be used by the next request the same worker handles, before normal setup resets it.
- Who is affected. PHP says every installation serving web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest on Apache mod_php, where there is a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs. For PHP-FPM, the most common setup on managed hosts, no complete exploit has been demonstrated yet, but PHP's own analysis says it is susceptible.
Why Your CMS Update Does Nothing Here
WordPress and Drupal updates replace WordPress and Drupal code. PHP sits underneath both, on the server, and it is patched by whoever runs the server.
On managed hosting, that is your host. On your own server or a virtual private server, it is you or your IT provider. Nobody at your association can fix this from the WordPress dashboard or the Drupal admin screens, and nothing in either one will tell you it needs fixing.
What Is Known About Attacks
Cloudflare's chief technology officer posted that the company is seeing early attacks. The security firm watchTowr says its honeypots have observed exploitation. Code claiming to exploit the flaws is circulating publicly and has not been independently confirmed to work. We could not confirm a listing in CISA's Known Exploited Vulnerabilities catalog as of this writing.
Read that plainly. That is enough to treat this as urgent. With a demonstrated unauthenticated exploit and details out a day before the planned release, the gap between patch and attack is measured in hours, not weeks.
What Hosts Have Said So Far
- SiteGround. Says it rolled out server-level mitigation rules and disabled the affected functionality on all supported PHP versions before the release, and that customers do not need to do anything. It did not say it had installed the fixed PHP versions.
- Pantheon. As of this afternoon, Pantheon has posted no release note or status entry about this. Its most recent PHP security update was on September 25, to versions that are now behind. Our own site runs on Pantheon, so we are watching for it as closely as you are.
- Everyone else. Check your host's status page and release notes today. Silence is not the same as protection.
What to Do Today
- Find your exact PHP version. In WordPress, Tools, then Site Health, then the Info tab, under Server. In Drupal, Reports, then Status report. You need the full number, such as 8.3.36, not just 8.3.
- Compare it to the fixed versions. You are covered at 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or any later release on the same branch.
- If you are below, contact your host today. Ask one question and get the answer in writing: has the fixed PHP release been deployed to our environments, and if not, when will it be? Ask about every environment, not only live, because development and staging sites run the same PHP on the same internet.
- If you are on PHP 8.1 or older. The PHP project no longer ships updates for those versions. It published source patches that a host or a long-term-support vendor can apply, but whether yours has done that is a question you have to ask. If the answer is no, the upgrade we wrote about for PHP 8.2's end of life is no longer a planning item.
- If you run your own server. Update, then restart every PHP worker. The second flaw lives in long-running workers, so a patch that is installed but not loaded protects nothing.
- After you are patched, check that you are clean. Exploitation reportedly started around the release. A patched site can still carry something placed before the patch arrived, which is the same lesson as the WordPress flaw this summer.
If Your Host Cannot Patch Immediately
PHP lists several configuration changes that reduce exposure to specific attack paths, and it is explicit that they do not make an installation safe. They include removing the memory limit, lowering the maximum POST size to 8 MB or 32 MB where uploads are needed, disabling session upload progress tracking with a restart of every worker, and on PHP 8.5, disabling fatal error backtraces.
These are server settings with tradeoffs, made by whoever administers PHP. They are not something to change through a WordPress plugin, and they are a stopgap measured in days, not a fix.
The Part Worth Remembering
Nearly every security post we have written this year has been about something you can update from the dashboard. This one is not in the dashboard at all. Before the next one, know the answer to a simple question: who patches the software underneath your website, and how fast?
If you cannot answer that today, that is the thing to fix this week, after the patch.