Two critical security flaws have been found in PHP, the programming language behind a huge number of websites. The PHP project released fixes on Wednesday, urging all users to update immediately. The flaws can let an attacker run their own code on a server without logging in.
The warning has come from several quarters at once. The US National Security Agency (NSA), the FBI, the UK's National Cyber Security Centre and WordPress have all urged site owners to act quickly. PHP had also given advance notice a day earlier that a critical security release was on its way.
What Exactly Is The Problem?
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS scale, which is among the most severe ratings. In simple terms, the first flaw is a memory-handling error. When PHP runs out of memory mid-request, it can mistakenly treat half-built, invalid data as valid.
The second flaw involves leftover data from an earlier request that is not cleared properly. A later request handled by the same worker can end up using it. In both cases, an attacker could exploit the confusion to execute code remotely.
Who Is At Risk?
Any PHP installation that serves web requests is exposed. That covers common setups such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP says the risk is highest with mod_php, where a demonstrated exploit can trigger an attack before any website code even runs.
ALSO READ | PHP Vulnerability: What Website Owners Need To Know About The NSA Warning
How To Fix It
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says there is no complete workaround, and updating is the only safe choice.
PHP 8.1 and older no longer get official security updates. The PHP team has issued limited emergency fixes for 7.4, 8.0 and 8.1 for people who build from source.
Users of these versions should check whether their Linux distributor or hosting provider offers backported fixes, or move to a supported version. PHP 8.2 itself reaches end of life on December 31, 2026.
If an update is not possible straight away, PHP suggests some stop-gap settings, such as lowering the maximum upload size. These only reduce exposure and do not make a server safe.
ALSO READ | 'PHP2Shell' Alert: Ajay Bagga Flags 'Most Severe' AI-Detected Bug That Puts 70% Of Global Websites At Risk
What WordPress Users Should Know
WordPress says the flaws are not specific to it and affect any server running PHP. No WordPress update is required or planned. Site owners should instead check with their hosting provider about its update plan, since many hosts may already be patching and adding protective firewall rules.
You can check your PHP version in WordPress under Tools > Site Health > Info > Server. Many hosting panels show it too.
What MeitY Is Advising
Separately, India's Ministry of Electronics and Information Technology (MeitY) has been pushing basic cyber hygiene advice as part of National Cyber Security Awareness Month this October. The post was not issued in response to the PHP flaws, but its advice is relevant for anyone running a website or storing data online.
In a post on X, the ministry urged users to maintain secure backups, use strong credentials and rely only on genuine operating systems and trusted software.
Its graphics, issued with CERT-In, the national cyber security agency, list several best practices:
Keep at least one backup disconnected from your devices to reduce ransomware risk. Use strong, unique passwords and multi-factor authentication for cloud backup accounts. Store backup passwords, recovery codes and encryption keys securely and separately from the backups.
Check regularly for failed, incomplete or outdated backups. Keep external drives in a safe place when not in use.
Offline Advice
The NSA, the FBI and the UK's National Cyber Security Centre have all said organisations that cannot update immediately should consider taking affected systems offline until they are fully protected.
The guidance is aimed mainly at systems that cannot be patched quickly, such as servers running PHP versions that no longer receive official updates. WordPress said this applies in particular to those who manage their own hosting.
The FBI has also asked organisations to watch their web servers for signs of attack, such as PHP processes unexpectedly launching command shells or downloading files.
Anyone who finds signs of a break-in should isolate the affected systems, preserve their server and PHP logs, and report the incident.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.