Critical PHP security vulnerabilities: How to fix them

Speculations have been making rounds on the internet that the websites which are using this software could be severely susceptible to cyber breaches.Details leaked ahead of schedule, forcing the PHP security team to advance the official patch release date to October 21, 2026.Hence the emergency patch will be released on October 21 at 14:00 UTC / 16:00 CEST / 10:00 EDT / 07:00 PT.

Aikido is working on releasing pre-patched base images to streamline deployment without requiring broad application upgrades.Fixed versions will also be released alongside full technical details.

The official patches are only provided for supported versions such PHP 8.2 and newer.

The older versions including PHP 8.1, PHP 7 and PHP 5 will not get an official PHP core patch.It is useless to change the configuration as previous workarounds and current WAF rules do not offer protection.If possible, remove internet-facing PHP applications from the public web until official patches are applied.

The moment patches are published, one must immediately apply PHP security updates.For compromise auditing, perform post-patch forensics covering logs back to June 2026 and look for Web shells and unexpected/modified files, newly created unauthorized admin users and anomalous outbound connections.

PHP.net confirmed two remote code execution flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, both rated at a critical 9.2 CVSS v4.0 score, which is critical.

The vulnerabilities reportedly…