PHP has scheduled an emergency release for two critical remote code execution flaws rated CVSS 9.2. Here is what is confirmed, what is still unknown, and the exact steps to protect your website today.
On October 20, 2026, the PHP project announced an out-of-band emergency security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It fixes two vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — both rated Critical with a CVSS v4.0 score of 9.2. Hosting providers including GoDaddy have published guidance urging every website owner running PHP to prepare immediately. Because PHP powers WordPress, WooCommerce, Magento, Drupal, Joomla, Laravel and a huge share of custom business software, this affects a very large part of the web.
The short version: back up your site, find out which PHP version you are running, and update to the fixed release as soon as your host or server makes it available. If you are on PHP 8.1 or older, you are on an end-of-life version that is not expected to receive an official fix — you need to upgrade to a supported version.
What Is Confirmed So Far
- Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated Critical (CVSS v4.0 9.2)
- Security researchers describe both as remote code execution (RCE) flaws in PHP core — meaning an attacker could potentially run their own code on an affected server over the internet
- The emergency release is scheduled for October 21, 2026 at 14:00 UTC (10:00 AM ET), and PHP has said it may ship earlier if details become public or attacks are observed
- Supported PHP branches will receive the fix; PHP 8.1 and older are end-of-life and are not expected to receive an official patch
- Operating system vendors, control panels (cPanel, Plesk) and hosting providers will publish their own updated builds on their own schedules after PHP's release
What Is Still Unknown
At the time of writing, PHP has not published the technical details or the exact list of affected versions — these will come with the release. Some security outlets have reported details from an early leak, including claims that the flaws affect every version since PHP 5 and that a proof-of-concept exists. These claims are not confirmed by the PHP project, and reports disagree with each other. The responsible assumption for any website owner is simple: treat every PHP site you run as affected until it is updated to a fixed release.
What Could Happen If You Do Nothing
Remote code execution is the most serious class of web vulnerability. Once technical details are public, automated scanners typically start probing the internet for unpatched servers within hours to days. A successful attack on an unpatched site can lead to stolen customer data, payment skimming on checkout pages, defacement, SEO spam injected into your pages, your server being used to send spam or attack others, or a full server takeover. For a business, the cost is rarely just technical — it includes lost sales, Google warnings on your domain and, in many countries, data breach reporting obligations.
Step-by-Step: What to Do Before the Fix Is Available
- 1Make an inventory: list every website, staging site and server that runs PHP, and note the PHP version of each — old staging sites and forgotten microsites are the easiest targets
- 2Take a full backup or server snapshot of every site — files and database — so you can recover quickly if anything goes wrong during the update
- 3Turn on automatic updates wherever your host or control panel offers them
- 4Consider setting session.upload_progress.enabled = 0 in php.ini as a temporary mitigation — hosting providers note this is not an official fix and may not be complete, and it can break upload progress bars, so test your site afterwards
- 5Talk to your hosting provider or developer now, so the update can be applied the moment builds are available rather than days later
Step-by-Step: Once the Fix Is Released
- 1Back up the site again immediately before updating
- 2Update PHP to the fixed release for your branch — in cPanel or Plesk this is usually done through the PHP version manager; on your own server, through your OS package manager or PHP build
- 3If you manage your own server, restart PHP-FPM and the web server (Nginx or Apache) so the new binaries are actually in use
- 4Verify the version with php -v on the command line, or in WordPress under Tools → Site Health → Info → Server, and compare it to the fixed version numbers in PHP's release announcement
- 5Repeat the check for every PHP version on the server — many servers run multiple versions side by side for different sites
Running PHP 7.4, 8.0 or 8.1? Updating "to the latest patch" is not enough, because there will be no official patch for your branch. You need to move to a supported version — PHP 8.3, 8.4 or 8.5. PHP 8.2 is also supported today but reaches end of security support on December 31, 2026.
Why Old PHP Versions Are Now a Business Risk
A lot of business websites still run on PHP versions that went end-of-life years ago, because "the site still works". Events like this one show why that is a false economy. When a critical flaw is found, supported versions get a fix within hours; unsupported versions get nothing. The longer an upgrade is delayed, the more code, plugins and libraries fall behind, and the more expensive the eventual upgrade becomes. For many older custom applications, this is also the moment to ask a bigger question: upgrade the PHP code, or rebuild it on a modern, secure Python stack such as Django or FastAPI.
How Frequent Solutions Can Help
Our team handles emergency PHP patching and full version upgrades for WordPress, WooCommerce, Magento, Laravel, CodeIgniter and custom PHP applications. We clone your site to staging, upgrade and test it there, and only then switch production — so you get protected without breaking checkout, logins or integrations. If your application is too old to upgrade safely, we can also plan a phased migration to Python. Contact us for a free audit of your PHP version and upgrade risk.