PHP Patch Day Lands Early: A Critical Update That Actually Cuts Through the FUD

Finland began unplugging government websites on Wednesday as two critical PHP vulnerabilities prompted the NSA to recommend that all organizations using PHP shut down their sites; the Netherlands and France took similar steps.

PHP powers about 70% of all websites whose server-side language is known, according to W3Techs, while every WordPress site runs on a PHP server, according to Wordfence, which was also down. The flaws allowed commands to be run on affected servers without logging in and were described as capable of letting attackers “pwn” affected websites. Security professionals call this unauthenticated remote code execution; it has also been described as “someone else is driving now.”

GoDaddy warned that attackers could steal data, deface sites or take over servers entirely, saying: “A flaw like this could let an attacker run their own code on an affected server over the internet, which can lead to stolen data, a defaced site, or a full takeover.”

The PHP Foundation, the nonprofit that funds the language’s development, raised the alarm on Tuesday, October 20, 2026. In a statement shared on X, The PHP Foundation (@ThePHPF) said: “The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.” The CVSS, or Common Vulnerability Scoring System, grades vulnerabilities from 0 to 10, with anything from 9.0 up labeled critical.

The fix landed at roughly 13:35 UTC on Wednesday, a few minutes ahead of the scheduled 14:00UTC release, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The first bug, CVE-2026-109618, occurs when PHP runs out of memory midway through request handling. Although releasing a patch does not mean every server has installed it, the security advisory said: “All PHP users are strongly encouraged to update immediately.”