Critical PHP Flaws Trigger Millions of Hacking Attempts; Web Publishers Told to Patch Now

WASHINGTON — Website operators are being urged to patch PHP immediately after the project disclosed two critical vulnerabilities that can allow unauthenticated attackers to run code on affected servers.

The PHP project released security updates on October 21 for CVE-2026-109618 and CVE-2026-109619. Both carry a Common Vulnerability Scoring System rating of 9.2. The project says every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It says no mitigation fully replaces installing a fixed version.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported by the project; operators using those branches must obtain a vendor backport or move to a supported version. The PHP security advisory provides the complete version and mitigation guidance.

The Cybersecurity and Infrastructure Security Agency also called for immediate patching. CERT-EU said proof-of-concept code had begun circulating and advised organizations that cannot patch immediately to isolate internet-facing applications until fixes are installed and verified.

Reuters reported Thursday that Cloudflare observed millions of attempted exploits after disclosure. Government and corporate services in Europe and Asia were temporarily taken offline while patches were applied. Precautionary shutdowns do not by themselves establish that those systems were breached.

The risk has direct implications for broadcasters and independent publishers because WordPress and many newsroom content-management systems run on PHP. The flaw is in the underlying PHP runtime, not WordPress itself, and one demonstrated attack can occur before application code runs.

News organizations should ask their hosting provider to confirm the active PHP version, verify that the applicable security update or vendor backport is installed across every web-facing account, restart affected workers as required and review logs for suspicious requests. Updating a WordPress plugin or theme alone does not patch the PHP runtime.