Critical security vulnerability in PHP; prompt update advised

Two critical security vulnerabilities have been identified in PHP, a programming language widely used for websites and servers. To mitigate these risks, the PHP security team has urged users to update their software immediately. If exploited, these flaws could allow attackers to execute code on a server remotely, without requiring a login.

In a security alert published on October 21, 2026, the PHP authorities stated that both vulnerabilities have been assigned a score of 9.2 out of 10 on the CVSS v4.0 scale, classifying them as "critical" risks.

Which Versions Are at Risk?

The PHP security update notes that the flaws have been addressed in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Earlier versions may remain vulnerable. PHP 8.1 and older versions no longer receive regular security updates from the core project; however, some operating system providers may offer separate patches.

One vulnerability stems from an error in memory management. The other relates to a scenario where internal data from a previous request is not properly cleared, potentially causing issues for subsequent requests. Under certain conditions, these flaws can be exploited to execute unauthorized code on a server.

Actions for Website and Server Administrators

Administrators of PHP-based websites, applications, and servers are advised to immediately check their current versions and install the relevant security updates. Priority should be given to servers that are directly accessible from the internet.

If an immediate update is not feasible, administrators should consider restricting network access to vulnerable systems or, if necessary, taking them offline temporarily. Server logs and any unusual activity should also be monitored. Simply changing configuration settings will not fully resolve these vulnerabilities; the only secure solution is to update to the patched versions.

Why Is This Important? PHP is used to generate dynamic website content, interact with databases, and perform various server-side tasks. Consequently, a critical security vulnerability in a PHP-powered server can put a website’s data, operations, and the server itself at risk.

Therefore, web developers, hosting providers, and system administrators are advised to take prompt action by following the official security guidelines provided for PHP.

Source: Official PHP security alerts and release notes.