We are aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on 21 October 2026. Either one allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.
PHP powers a significant share of the web, including Joomla, WordPress, Drupal, Laravel and countless custom applications. Websites on our managed hosting platform have already been patched. For non-managed services and your other infrastructure, this issue warrants action.
Who is affected
These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your web infrastructure, consider yourself potentially in scope until you have patched. That includes cPanel hosting, VPS and cloud servers (such as DigitalOcean Droplets and AWS), app platforms and custom containers, LAMP and LEMP stacks, and previously deployed CMS websites.
Patched PHP versions
| PHP branch | Patched version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 or earlier | No patch available |
Patches are only available for currently supported PHP versions (8.2 and later). If you are running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.
Need a hand?
If you are not sure which PHP version your website or server runs, or you need help upgrading safely, call 1300 566 652 or send us a message and we will check it for you.
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
