The PHP security team released emergency patches to fix two serious vulnerabilities, one of which was found with the assistance of an AI model. Several French government services and public websites temporarily shut down their online services while updates were applied. Here’s an overview of what happened and what you need to know.
Scientists confirm: This is the most effective way to get your cat’s attention, according to new research
Elderly Couple Refuses Reserved Seats—Viral Train Standoff Sparks Fiery Debate on Courtesy
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2/10 on the CVSS v4.0 scale, are located in PHP’s core engine in areas that handle memory. Because the defects are in the runtime itself, any application running on an unpatched PHP version is at risk regardless of its own code. The impact is substantial: PHP is used by 69.3% of websites for which the server-side language is known (per W3Techs), powering platforms from WordPress and Drupal to Magento and Joomla.
Remote takeover possible without credentials
According to the security advisory published by the PHP team, an attacker can leverage these memory-handling bugs to execute arbitrary code on the server. All types of web-facing PHP deployments are affected, including:
- PHP-FPM,
- Apache using mod_php,
- php-cgi,
- FrankenPHP,
- LiteSpeed.
Why You Should Never Reheat These Foods in the Microwave – The Hidden Dangers Experts Warn About
I tried the top 5 guard dogs—here’s what makes these breeds the ultimate protectors
mod_php is considered the most dangerous vector: a single specially crafted request can trigger exploitation even before the application’s own code runs. On Tuesday, October 20, PHP’s security team said patches would be published on October 21 at 16:00 Paris time; CERT-EU reported the fixes were posted at about 15:30. One of the vulnerabilities was identified by the company Calif using the GPT-5.6 Sol model, and the security firm Wiz independently discovered both issues, according to a blog post from OpenAI.
How to protect a site running PHP
On October 21 the CERT-FR (part of ANSSI) issued an alert listing affected systems and recommended actions. The PHP security team and several hosting providers, including GoDaddy, have put out guidance as well. The PHP team stresses that applying the official update is the only way to completely eliminate the risk.
Check which PHP versions you run and install the patch
You can see the PHP version in a command shell with php -v or, for WordPress sites, under Tools > Site Health > Info > Server, notes GoDaddy. The fixed releases are:
- 8.5.12 for the 8.5 branch
- 8.4.27 for the 8.4 branch
- 8.3.36 for the 8.3 branch
- 8.2.35 for the 8.2 branch
Points to check when updating PHP
Consider these steps before and during the upgrade:
- Inventory every PHP installation, including bundled copies of PHP embedded in other software that may not advertise the runtime, as advised by CERT-EU.
- If you’re on shared or managed hosting, confirm with your provider that they have applied the update.
- On Linux servers, obtain patched packages from your distribution’s repositories — maintainers received fixes upstream, according to the PHP project.
- On control panels like cPanel or Plesk, switch the PHP version from the panel.
- Make a backup before changing versions, then restart PHP and the web server and verify the active version on every affected host, as GoDaddy recommends.
Isolate unpatched servers and look for signs of compromise
Until the patch is applied, CERT-FR and CERT-EU advise isolating vulnerable systems from public networks. Proof-of-concept exploit code is already circulating, increasing the likelihood of active attacks, the CERT-EU warns. For servers that remain exposed, CERT-FR points to its quick-reference guide on dealing with a compromised network edge device, which lists immediate containment steps and investigative actions.
What about unsupported PHP versions?
CERT-FR also counts older branches (5.x through 8.1.x) among affected systems even though those lines are no longer maintained by the PHP project. W3Techs reports that 26.9% of PHP sites still run version 7 and 7.7% run version 5. CERT-FR urges migration to a supported release. The PHP team released minimal source patches for 7.4, 8.0 and 8.1 intended for organizations that build PHP themselves.
Sites taken offline as a precaution
Following ANSSI’s recommendation, the French Interior Ministry placed many of its externally accessible online services into preventive maintenance, according to a statement relayed by Le Monde.
“At ANSSI’s request, the Interior Ministry has put several of its websites into preventive maintenance. This follows the announcement, a few hours earlier, of a critical security vulnerability in a widely used generic software component. Prefecture websites are temporarily unavailable. Consult prefecture social channels or posted notices for official acts, alerts and instructions. Our teams are working to update the services as quickly as possible.” — Interior Ministry (translated)
ANSSI reports that more than 600,000 servers on the French internet run PHP. The agency recommends taking affected servers offline where feasible until updates are applied. It also says it shared the CERT-FR alert nationally and internationally with other CERTs (national, ministerial, sectoral and territorial partners). On X (formerly Twitter), ANSSI warned of two critical vulnerabilities “whose rapid exploitation is to be feared.”
If you operate web infrastructure, prioritize identifying PHP installs, apply the vendor or distribution-supplied patches promptly, isolate any systems you cannot patch immediately, and investigate for signs of intrusion. Only by updating to the corrected releases or taking systems offline can you remove the immediate risk posed by these flaws.
Similar Posts
- DDoS Attack on Your Business: Essential Steps to Respond and Protect!
- Cyber Resilience Act 2026: Major Changes for Digital Professionals Starting September 11
- Safari 26.6.1 Update Fixes Critical Sonoma and Sequoia Vulnerabilities: Secure Your Browser Now!
- Cybersecurity Alert: Top 5 Precautions for Remote Work Safety
- WhatsApp Privacy Scandal: Are Your Messages Really Private? Serious Doubts Emerge
Jordan Park writes in-depth reviews and editorial opinion pieces for Touch Reviews. With a background in UI/UX design, Jordan offers a unique perspective on device usability and user experience across smartphones, tablets, and mobile software.