Source: https://reinouttebrake.com/stories/is-the-php-security-flaw-fixed-what-website-owners-need-to-know [All articles](https://reinouttebrake.com/articles)[Share on WhatsApp](https://wa.me/?text=Is%20the%20PHP%20Security%20Flaw%20Fixed%3F%20What%20Website%20Owners%20Need%20to%20Know%0Ahttps%3A%2F%2Freinouttebrake.com%2Fstories%2Fis-the-php-security-flaw-fixed-what-website-owners-need-to-know) [PHP Security](https://reinouttebrake.com/category/php-security) 21 Oct 2026 3 min read # Is the PHP Security Flaw Fixed? What Website Owners Need to Know By [Reinout te Brake](https://reinouttebrake.com/about) Updated 21 Oct 2026 ![Computer servers housed in server racks. Illustrative photograph.](https://reinouttebrake.com/assets/editorial/php-servers-1280.webp) Computer servers in a server rack. Illustrative photograph: CSIRO / Wikimedia Commons. [Source & licence](https://reinouttebrake.com/data#image-credits) Two serious security flaws in PHP prompted urgent warnings and updates on 21 October 2026. They can allow attackers to run code on vulnerable servers without logging in. The fixes are available. Whether your website is protected depends on whether its hosting provider or administrator has actually installed and activated them. ## What is PHP, in simple terms? PHP is a programming language used behind the scenes to make websites work. It runs on the server: the computer that processes visitors’ requests and sends pages back to their browsers. You might never see PHP, but your website or a service you use may depend on it. The [Dutch National Cyber Security Centre](https://github.com/NCSC-NL/php2shell) warns that PHP is also embedded in network devices, management interfaces and other products. ## What happened with PHP in October 2026? Two vulnerabilities were disclosed: CVE-2026-109618 and CVE-2026-109619. Both involve mistakes in how PHP manages its working memory. One can occur when PHP runs out of memory. The other involves leftover internal information being used after its memory has already been released. Under certain conditions, attackers can exploit these mistakes to execute their own code. Both vulnerabilities received a severity rating of 9.2 out of 10. ## Can hackers attack without a password? Yes. The [official PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) confirms that exploitation can happen without authentication. In a demonstrated attack against one server configuration, the problem is triggered before the website’s own code starts running. That means the website’s login screen cannot stop that particular attack. ## Have the PHP security flaws been fixed? Yes. PHP released four security updates on 21 October: - PHP 8.2.35 - PHP 8.3.36 - PHP 8.4.27 - PHP 8.5.12 These versions fix both vulnerabilities. Some suppliers also provide packages containing the fixes under different version numbers. Older installations need particular attention. PHP 8.1 and earlier no longer receive regular PHP-project updates, although some vendors provide extended support. ## Does this mean every PHP website was hacked? No. A vulnerability creates an opportunity for an attack; it does not prove an attack happened. However, [CERT-EU reports](https://cert.europa.eu/publications/security-advisories/2026-018/) that technical details and early demonstrations of exploitation are circulating. That makes prompt action important. Its advisory does not establish how many websites have been compromised. ## What should website owners do now? Ask your hosting provider or administrator to confirm whether your website uses PHP, which security update has been applied, and whether the live service is running the updated software. Updating a website plug-in alone does not establish that PHP itself has been repaired. If patching is delayed, temporary settings can reduce some risks, but official guidance says they do not provide complete protection. The useful question now is: has the fix been verified on the server actually running your website? The existence of an update cannot answer that. For broader security context, [my analysis of the Bybit hack](https://reinouttebrake.com/stories/the-1-5-billion-crypto-heist-how-bybits-hack-exposed-a-deeper-industry-crisis) examines transaction approval risks, while [my article on OpenAI’s Medicare breach](https://reinouttebrake.com/stories/openai-reported-an-ai-breach-nearly-three-months-later-now-it-backs-mandatory-reporting) looks at incident disclosure and reporting. These are separate incidents with different causes. ## Sources and context - [PHP: critical security advisory and fixed releases](https://www.php.net/archive/2026.php#2026-10-21-5) (Primary source) - [PHP: CVE-2026-109618 — memory corruption advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) (Primary source) - [PHP: CVE-2026-109619 — stale global state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) (Primary source) - [CERT-EU: affected versions, risk and recommended action](https://cert.europa.eu/publications/security-advisories/2026-018/) (Primary source) - [NCSC-NL: operational guidance and affected software](https://github.com/NCSC-NL/php2shell) (Primary source) ## Tags - [PHP Security](https://reinouttebrake.com/tag/php-security) Written by [Reinout te Brake](https://reinouttebrake.com/about) Gaming · AI · Tech · Entertainment · Dance Entrepreneur, consultant, investor and board member with 20+ years in tech and gaming, spanning business strategy, development, publishing, growth and investment. [Share on WhatsApp](https://wa.me/?text=Is%20the%20PHP%20Security%20Flaw%20Fixed%3F%20What%20Website%20Owners%20Need%20to%20Know%0Ahttps%3A%2F%2Freinouttebrake.com%2Fstories%2Fis-the-php-security-flaw-fixed-what-website-owners-need-to-know)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Freinouttebrake.com%2Fstories%2Fis-the-php-security-flaw-fixed-what-website-owners-need-to-know)[Share by email](mailto:?subject=Is%20the%20PHP%20Security%20Flaw%20Fixed%3F%20What%20Website%20Owners%20Need%20to%20Know&body=https%3A%2F%2Freinouttebrake.com%2Fstories%2Fis-the-php-security-flaw-fixed-what-website-owners-need-to-know) Cite this article Reinout te Brake. Is the PHP Security Flaw Fixed? What Website Owners Need to Know (21 Oct 2026). [https://reinouttebrake.com/stories/is-the-php-security-flaw-fixed-what-website-owners-need-to-know](https://reinouttebrake.com/stories/is-the-php-security-flaw-fixed-what-website-owners-need-to-know) [Article data (JSON)](https://reinouttebrake.com/data/articles/is-the-php-security-flaw-fixed-what-website-owners-need-to-know.json)[Full article text](https://reinouttebrake.com/stories/is-the-php-security-flaw-fixed-what-website-owners-need-to-know.txt)[Markdown](https://reinouttebrake.com/stories/is-the-php-security-flaw-fixed-what-website-owners-need-to-know.md) Next / Read ## Related reading Follow the subject further. ![Sam Altman at The Grove in November 2022](https://reinouttebrake.com/assets/editorial/altman-1280.webp) [Image: Village Global](https://reinouttebrake.com/data#image-credits) Related analysis OpenAI 7 Oct 2026 ### [OpenAI’s Medicare Breach: Disclosure and Reporting Rules](https://reinouttebrake.com/stories/openai-reported-an-ai-breach-nearly-three-months-later-now-it-backs-mandatory-reporting) OpenAI’s agent accessed a Medicare portal without authorisation. Examine the notification timeline and the company’s support for mandatory incident reporting. [Read analysis](https://reinouttebrake.com/stories/openai-reported-an-ai-breach-nearly-three-months-later-now-it-backs-mandatory-reporting) ![Physical Bitcoin and Ethereum tokens on a yellow background](https://reinouttebrake.com/assets/editorial/archive-photo-14911432-1280.webp) [Image: Jonathan Borba / Pexels](https://reinouttebrake.com/data#image-credits) Related analysis Gaming 7 Mar 2025 ### [Bybit’s February 2025 Hack: Crypto Security and Web3 Risk](https://reinouttebrake.com/stories/the-1-5-billion-crypto-heist-how-bybits-hack-exposed-a-deeper-industry-crisis) The February 2025 Bybit theft exposed risks in crypto custody and transaction approval. Explore the incident, the response and implications for Web3. [Read analysis](https://reinouttebrake.com/stories/the-1-5-billion-crypto-heist-how-bybits-hack-exposed-a-deeper-industry-crisis) [More in PHP Security](https://reinouttebrake.com/category/php-security)