Critical PHP vulnerabilities in 2026: patch now, plan migration carefully

Who should act on the current PHP warning

PHP released security updates for two critical flaws on 21 October. The vendor considers installations serving web requests at risk. It rates the demonstrated mod_php risk particularly highly: an attack can begin before application code runs. PHP: official security advisory ↗

What the two vulnerabilities mean in plain language

With CVE-2026-109618, memory exhaustion can leave internal data only partly initialised. Later processing may turn that into unsafe memory use. The flaw concerns the PHP runtime; changing the visible text on a website does not fix it. PHP: technical description of the memory flaw ↗

CVE-2026-109619 concerns internal state surviving a request even though its memory has been freed. That state can become dangerous when the same worker handles another request. The advisory describes confirmed paths involving mod_php and FPM; it does not establish identical exploitability for every installation. PHP: technical description of the state flaw ↗

Which PHP versions contain the fixes

The PHP changelog documents the corrected upstream releases. Within each release series, the following versions contain fixes for the two flaws discussed here; later security releases should also be considered. PHP: official changelog ↗

For distribution packages, the complete revision matters: Ubuntu lists 8.3.6-0ubuntu0.24.04.13 for 24.04, for example. Assessment must therefore include the vendor notice and actual package source. Comparing only with the upstream table can incorrectly flag an already corrected package. Ubuntu: corrected package revisions ↗

PHP publishes an overview of regularly supported release series. Older systems therefore also require checking who supplies security maintenance. Ask for a concrete maintenance agreement and a verifiable fix revision rather than treating a website's continued availability as evidence of support. PHP: official support overview ↗

Updating WordPress alone does not fix this

WordPress explicitly calls for updating PHP. No separate WordPress update is planned for these runtime flaws. Its PHP version is shown under Tools → Site Health → Info → Server; ask the hosting provider to confirm the actual patch status as well. WordPress: vendor notice ↗

Why waiting is a poor strategy

AWS calls the flaws PHP2Shell and reports attack attempts in its own MadPot telemetry as early as 17 October, before public disclosure. Whether those early attempts succeeded against real systems was unclear. AWS describes widespread exploitation after publication. This observation does not establish compromise of your website, but reinforces the urgency of checking it. AWS: original exploitation telemetry report ↗

Approach PHP patching with a defined scope

Our proposed maintenance engagement starts with an inventory and ends with checkable results. We agree scope, access, maintenance windows and responsibilities before implementation. A possible sequence is:

1. Map websites, hosting, package sources and running PHP services.
2. Identify the appropriate vendor fix and required application checks.
3. Agree backups, recovery arrangements and how failures will be handled.
4. Apply the update within scope and restart affected services in a controlled way.
5. Check important user journeys such as sign-in, forms and checkout.
6. Document package revisions, checks and outstanding work.

Advertisement · Bissolux: Need to know whether your website is affected, or help applying an update? Send us its address, the hosting provider and a short description. We will agree a suitable assessment and maintenance scope with you. Request PHP assessment and patching help ↗

When migrating from PHP to Next.js makes sense

A move may be worthwhile when your website already needs rebuilding, old extensions take substantial maintenance effort, or custom features and integrations are planned. We assess content, workflows, maintainability and operating costs together. The benefit comes from suitable architecture and implementation, rather than a framework's name.

Next.js also requires deliberate security boundaries. Its documentation recommends server-side data access with authorisation checks and minimal returned data. Publicly reachable Server Actions need their own authentication and authorisation checks. A migration does not remove these responsibilities. Next.js: official data security documentation ↗

Advertisement · Bissolux: We can plan and implement the replacement of your PHP website with Next.js. Together we inventory existing features, forms, content, redirects and integrations, including an agreed cutover and rollback plan. Effort and price are agreed for the particular engagement. Discuss a PHP-to-Next.js migration ↗

Your decision in practical steps

1. Have the runtime and complete package revision established for each production website.
2. Commission immediate remediation and verify its implementation; plan migration separately.
3. Contact Bissolux with your website address and desired assistance, without sending credentials in the form.

Frequently asked questions