Is my PHP site affected by the October 2026 critical PHP vulnerability?

What is the October 2026 PHP vulnerability?

It’s a pair of critical security flaws in PHP itself that can allow unauthenticated remote code execution: an attacker running their own code on your server without logging in. The PHP team rated both 9.2 on the CVSS v4.0 scale and fixed them in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 (php.net security advisory).

They are CVE-2026-109618, which the PHP team calls “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w), and CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp).

Some security reporting calls the pair “PHP2Shell.” That’s a nickname, not the PHP team’s name for them (BSI, Germany’s federal cybersecurity agency, in German).

The PHP team reports a demonstrated exploit against Apache with mod_php (php.net security advisory). As of 8 a.m. ET, no attacks had been confirmed: the BSI noted unconfirmed reports of exploit code (BSI warning), and neither flaw was in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog when we checked it at 7:44 p.m. ET.

Who is affected?

Every PHP installation that serves web requests and hasn’t been updated, the PHP team says, including those running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed (php.net security advisory).

WordPress, Drupal, Laravel and Symfony all run on PHP, so start with the PHP version on your server.

The PHP team rates the risk highest for Apache with mod_php (php.net security advisory). The CVE records list PHP 8.2 to 8.5 before the fixed releases as affected (CVE-2026-109618, CVE-2026-109619). They don’t cover end-of-life versions, and the PHP team published patches for 7.4, 8.0 and 8.1, so treat older versions as affected too (php.net security advisory).

Which PHP versions get the fix?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry it. PHP 8.1 and older are end-of-life and get no release (php.net supported versions).

PHP branches and whether they get the October 21, 2026 security fix

Branch	Support today	Security fixes until	This fix
PHP 8.5	Active support	December 31, 2029	Yes: PHP 8.5.12
PHP 8.4	Active support	December 31, 2028	Yes: PHP 8.4.27
PHP 8.3	Security fixes only	December 31, 2027	Yes: PHP 8.3.36
PHP 8.2	Security fixes only	December 31, 2026	Yes: PHP 8.2.35
PHP 8.1 and older	End-of-life	Ended	No release. Minimal source patches for 7.4, 8.0 and 8.1; some vendors ship backports

Support dates are from php.net’s supported versions page and fixed versions from its security advisory, read at 10:00 a.m. ET on October 21, 2026.

How do I check which PHP version my site runs?

Look in your site’s dashboard or your host’s control panel, or ask your host.

• WordPress: Tools, then Site Health, then Info, then Server.
• Drupal: Reports, then Status report.
• Your host: ask which PHP version serves your site, and whether they’ve applied the fix.
• On the server: php -v shows the command-line PHP, which can differ from the PHP that serves your site.

What should I do right now?

Update every supported PHP install to its fixed release now. On PHP 8.1 or older, get your vendor’s backported fix or cut your exposure today, then upgrade to a supported version.

1. List your PHP sites. Include staging copies, old marketing sites and internal tools, not just the main app.
2. Check each version. Use the steps above, and note who runs each server: you, your host or an agency.
3. Upgrade supported versions. On PHP 8.2, 8.3, 8.4 or 8.5, install the fixed release for your branch (table above), through your host, your Linux distribution’s security updates or your own build. Distributions and long-term-support vendors got the patches in advance, so check your vendor for updated packages (php.net security advisory). Test, then deploy.
4. Reduce exposure where you can’t update yet. The PHP team lists configuration changes that cut some attack paths but don’t make an installation safe (php.net security advisory). The European Union’s cybersecurity service says organizations should consider isolating internet-facing applications from public networks until a fix is applied (advisory 2026-018).
5. Don’t wait on end-of-life PHP. Get a backported fix or cut your exposure now, then plan the upgrade. See the next section.
6. Confirm it landed. Check the version again on the server that serves the site, or confirm your vendor’s package update is installed.

What if my site runs PHP 8.1 or older?

Upgrade or migrate: PHP 8.1 and every older version are end-of-life, so the PHP team no longer ships releases for them (php.net supported versions).

For this pair, the PHP team made an exception and published minimal source patches for PHP 7.4, 8.0 and 8.1, for people who build PHP themselves. Some distributions and long-term-support vendors ship backported fixes, so ask yours (php.net security advisory).

Until you’ve upgraded, treat these sites as exposed: apply a backported fix if you can get one, and use the exposure-reducing steps in step 4 above.

Moving off an old version can mean updating your framework, your plugins and code that relied on features PHP has since removed, so plan it and test it before it reaches your live site. Aim for PHP 8.3 or newer: security support for 8.2 ends December 31, 2026.

How can Camber help?

Apply for a free audit of one PHP repository, with a plan to upgrade your PHP.

We have considerable experience with PHP, with or without Laravel, and with Drupal and WordPress. For a time, we were a WordPress VIP Gold Agency Partner with Automattic. Our team earned Acquia certification in Drupal.

We’ve worked in 44 codebases with PHP in them since 2016, across WordPress, Laravel, Drupal and Symfony, counted from our own repositories on October 21, 2026.

We’re an AI-native app design and development studio that’s been building enterprise-grade apps since 2014.

The audit reviews your code. It isn’t a penetration test of your server. No repository to share? Tell us about your project.

Where does this information come from?

From the PHP team, the CVE program and government security agencies, each read on October 21, 2026:

• The PHP team’s security advisory and release announcements, and the PHP 8 ChangeLog, 10:00 a.m. ET.
• php.net’s supported versions, 10:00 a.m. ET.
• The php-src advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, 10:01 a.m. ET.
• The CVE records CVE-2026-109618 and CVE-2026-109619, 10:01 a.m. ET. The US National Vulnerability Database had no entry for either yet.
• The European Union’s cybersecurity service, advisory 2026-018, 10:01 a.m. ET.
• Germany’s federal cybersecurity agency, BSI warning (in German), 8:02 a.m. ET.
• CISA’s Known Exploited Vulnerabilities catalog, 7:44 p.m. ET.

Our experience and repository count come from our own records.