Patch todayPHPWebsites & online stores

Two PHP flaws let attackers take over web servers with no login

Who's affected: Websites and web apps that run on PHP, which includes most WordPress sites. Researchers estimate more than 32 million PHP services are still on an affected version.
Under attack?: Yes. CISA confirmed active exploitation on Oct. 26, two days after researchers saw successful attacks on test servers.
What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.
Fixed in: PHP 8.5.128.4.278.3.368.2.35
CISA deadline: Federal agencies must fix this by Oct 29, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-109618 CVE-2026-109619Severity score 9.2/10Chance of attack in 30 days: 100% (EPSS)Listed Oct 26, 2026Source: The Hacker News ↗

Also covered here: CVE-2026-109618.

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: PHP

Hi [Client name],

Attackers are actively exploiting a security flaw in PHP.

Who's affected: Websites and web apps that run on PHP, which includes most WordPress sites. Researchers estimate more than 32 million PHP services are still on an affected version.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.

Fixed in: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
Reference: CVE-2026-109618, CVE-2026-109619 – https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

Two PHP flaws let attackers take over web servers with no login

Also under attack in Websites & online stores