Request a Quote

Critical PHP Remote Code Execution Flaws Require Immediate Patching

By Nicky Smith
Technology Leader with Over 45 Years of Experience

After more than four decades working with technology systems—from legacy school intercom amplifiers and district call routing to modern cloud-hosted VoIP platforms—I have learned that the most dangerous exposures are often the ones that sit quietly in the background until someone notices them. Today, one of those exposures is PHP.

PHP still powers roughly 69 percent of websites whose server-side language can be identified, according to W3Techs. That includes countless business sites, school portals, e-commerce platforms, and the contact or lead-capture pages that organizations rely on every day. Two newly confirmed critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619—have changed the risk picture for any site still running unpatched PHP.

Both flaws carry a CVSS score of 9.2. The first involves out-of-memory handling that can leave request data in a partially initialized state; cleanup routines may then treat that invalid data as valid and enable remote code execution. The second involves request-owned internal state that can survive after its backing memory is freed, allowing a later request on the same worker to reuse stale data. In both cases, successful exploitation can give an unauthenticated attacker the ability to run code on the server.

PHP versions from 5.4 through 8.5.11 are affected. Official patches are available for the currently supported branches: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These updates were released this morning, October 21, 2026, around 10 a.m. Eastern. PHP 8.1 and earlier will not receive official fixes from the project because those versions have reached end of life. Some distribution vendors may offer limited backports, but the practical recommendation for any organization still on those older releases is to upgrade.

A proof-of-concept circulated ahead of the official release, and security researchers have reported probing activity. The highest demonstrated risk is on Apache with mod_php, where an unauthenticated request can trigger the issue before application code even runs. PHP-FPM, php-cgi, and other common deployments are also in scope. Common platforms such as WordPress, Drupal, and Joomla have been shown to be reachable under default or near-default conditions.

From the work I have done with North Carolina schools, local governments, and businesses over the past twenty-plus years, I know how tightly web properties are woven into daily operations. A school district’s website may handle parent communications, online forms, or emergency notifications. A business site may capture leads that feed into sales or support systems that ultimately connect to phone and messaging platforms. When that front door is left unpatched, the rest of the communications infrastructure can be placed at risk even if the voice systems themselves are properly configured and monitored.

The immediate steps are straightforward:

  • Identify the PHP version in use on every public-facing site and internal web application.
  • Apply the official patches today if you are on PHP 8.2 or newer.
  • Treat anything older than 8.2 as permanently exposed and schedule an upgrade or migration as a priority.
  • A free checker such as the one offered by CybaVerse can give a preliminary indication of exposure, but it is not a substitute for verifying the actual version and applying the fix.
  • Review related systems—content management platforms, custom applications, and any hosting control panels—that depend on PHP.

Security work is never finished. The same discipline we apply when configuring redundant call paths, proper emergency calling, or hardened VoIP edges applies here: know what is running, keep it current, and do not assume an unattended system will remain safe. The organizations that handle these updates quickly limit the window attackers can use.

If your team needs help evaluating the broader communications environment that surrounds your website—phone systems, contact routing, or the reliability of the platforms that support customer and constituent interactions—Carolina Digital Phone has been assisting schools, businesses, and local governments across North Carolina for years. The goal remains the same: keep the systems people rely on running securely and without interruption.

References

You May Also Like