PHP’s Oct. 21 emergency release fixed two critical flaws that could let unauthenticated attackers run code on web servers, while the response highlighted the small pool supporting the language’s security work.
A joint statement from the European Union Agency for Cybersecurity (ENISA) said PHP’s security team released updates at 9:40 a.m. ET (13:40 UTC). The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each scored 9.2, Critical, under version 4.0 of the Common Vulnerability Scoring System. PHP issued fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory says all installations serving web requests are affected and updating is the only complete fix.
The PHP Foundation said the release had initially been scheduled for Oct. 22 at 10 a.m. ET (14:00 UTC). The foundation said the vulnerability identifiers began circulating on forums and social media around 11 a.m. ET (15:00 UTC) Oct. 20, prompting the project to move the release forward by a day.
The Atlantic reported that Ondřej Surý, director of domain-name-system engineering at the nonprofit Internet Systems Consortium, maintains PHP packages as a volunteer. Surý told the magazine he has packaged PHP since version 5 and prepared installable packages from source code, allowing administrators to roll out updates across large server fleets without compiling PHP themselves. “If I was not available, it would take more time; some of them wouldn’t have the skills,” Surý told The Atlantic.
W3Techs reported that PHP was used by 69.3% of websites for which it could identify a server-side language, based on data current as of Oct. 22. The PHP Foundation says the security work is carried mainly by a small group of developers it funds, with limited volunteer help. It has called on companies, hosting providers, cloud platforms, software distributions and governments that rely on PHP to help fund that work.
PHP 8.1 and earlier no longer receive regular updates from the project. PHP supplied limited source backports for versions 7.4, 8.0 and 8.1, while some distributors and long-term-support vendors may provide other fixes. Administrators can check with their providers for updates to older versions.
