PHP Releases Urgent Security Updates to Address Critical Vulnerabilities
Emergency fixes for PHP vulnerabilities released on October 21, 2026, to protect websites from potential attacks.
PHP has issued critical updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Websites using Apache servers are particularly vulnerable, with potential for code execution by attackers.
Website owners are urged to update PHP immediately to mitigate risks.
On October 21, 2026, the PHP security team announced emergency updates to address two significant vulnerabilities that could allow attackers to execute code on web servers without authentication. The updated versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with PHP emphasizing that updating is the only secure option as no workaround can fully mitigate these risks.
The vulnerabilities affect all installations handling web requests, with Apache servers utilizing mod_php being at the highest risk. An attack can potentially execute before the website's own code is initiated, making it crucial for website operators to act swiftly. Notably, PHP is the underlying technology for platforms like WordPress, which means that merely updating WordPress or its plugins will not suffice; users must ensure their PHP version is also updated.
For those still using PHP 8.1 or older, which are no longer supported with regular updates, PHP has provided limited fixes for versions 7.4, 8.0, and 8.1 for developers who compile PHP themselves. Hosting providers may also offer their own updates, but these do not restore ongoing support. Website operators are advised to consult their hosting providers to ensure they are protected while planning an upgrade to a supported version.
In anticipation of these vulnerabilities being exploited, several government websites, including those of the Dutch parliament and Finnish government, were taken offline as a precautionary measure. This proactive approach was recommended by cybersecurity agencies, including CERT-EU and the UK National Cyber Security Centre, highlighting the seriousness of the threat.
Moving forward, website owners should follow the WordPress PHP guide to check their PHP version and request their hosting provider to install the necessary updates. If immediate patching is not feasible, they should consider taking their site offline to prevent potential exploitation. After applying the updates, it is crucial to conduct a thorough audit for any signs of compromise, as the patch does not eliminate existing threats. As the cybersecurity landscape evolves, website owners must remain vigilant and prepared for more severe vulnerabilities in the future.
