On October 21, the PHP project released emergency fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These flaws let an unauthenticated attacker run code on a server with a single crafted web request. Attacks are already being reported in the wild.
Most coverage says “update PHP now.” That advice is right, but it assumes you can. If your application runs on PHP 7.x or 5.x, you probably can’t.
Older versions are affected, and there is no patch for them. Fixes were released only for PHP 8.2 and later. The PHP project’s emergency backports for 7.4, 8.0, and 8.1 confirm those versions are vulnerable, and both AWS and Abstract Security report the flaws reach back to PHP 5.4. Google Cloud likewise lists PHP 5.5 applications among those that remain vulnerable. The official configuration workarounds reduce risk but don’t eliminate it, and AWS states one of the two flaws has no fix at all on end-of-life versions.
Upgrading the server is not enough. An application built for PHP 5 or 7 will usually not run on PHP 8.3 unchanged. Removed functions, stricter type handling, deprecated language features, and outdated frameworks, CMS versions, and libraries all break during the jump. Teams that have put off the upgrade have generally done so because it requires real application work, not just a server change.
Don’t stop at PHP 8.2. PHP 8.2 loses security support on December 31, 2026. If you’re upgrading now, target PHP 8.3 or newer so you aren’t back in this position in ten weeks.
What to do this week:
Inventory every PHP application you run, including old internal tools and “set and forget” sites, and record its PHP version.
Apply the interim mitigations from PHP’s advisory to anything you can’t upgrade immediately.
For anything on PHP 8.1 or older, start planning the application upgrade now, not just the server upgrade.
We can help. Achieve Internet has been modernizing PHP applications for decades. We can assess your applications, identify what will break on a supported PHP version, and handle the code and dependency upgrades to relieve the burden of maintaining legacy systems, preventing operational disruption so your team can stay focused on core business priorities.
Official advisory: https://www.php.net/archive/2026.php#2026-10-21-5
