On Wednesday, October 21, 2026, a major cybersecurity alert was issued about PHP, the programming language used by about 70% of websites, including WordPress sites. Two critical vulnerabilities, rated 9.2 out of 10, could let hackers remotely execute malicious code, compromise servers, or even take complete control.
- Two critical security vulnerabilities affect PHP, with a reported severity score of 9.2 out of 10.
- Millions of websites, particularly those powered by WordPress, could be exposed to attacks aimed at compromising their servers.
- Security patches have been available since October 21, 2026, for PHP versions 8.2, 8.3, 8.4, and 8.5.
- Immediate action required: check your PHP version and install the available security patches. Older, unsupported versions require special attention.
Two Extremely Severe PHP Vulnerabilities: Widespread Attacks Feared
The PHP security team released four security updates on October 21, 2026: PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, to address these two critical vulnerabilities.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow remote takeover of vulnerable servers.
Technical information had already leaked before the patches were released, raising concerns among cybersecurity experts about the rapid, large-scale exploitation of these vulnerabilities. WordPress websites and PHP-based business applications are affected. Systems running outdated, unsupported versions are especially exposed.
What Steps Should You Take to Protect Your Website and PHP Server?
Website administrators and businesses must act quickly to reduce exploitation risk.
- Check the PHP version used by your website or server through your hosting provider.
- Install the available security patches for PHP 8.2, 8.3, 8.4, and 8.5.
- Upgrade older PHP versions, particularly PHP 7, PHP 8.0, and PHP 8.1, which no longer receive official security support.
- Contact your hosting provider to confirm whether they’ve applied the security patches or whether you need additional protective measures.
- Temporarily restrict access to vulnerable systems when you can’t apply updates immediately.
For businesses using WordPress, updating the CMS and its plugins does not replace updating PHP, which must be handled at the hosting or server level.
Official sources: PHP – Security Announcements and Updates.
Warning: Temporary protective measures are no substitute for installing PHP security patches. Because attackers may exploit these vulnerabilities before application code even runs, updating PHP on the server remains essential.
Servers running older PHP versions, including PHP 5, PHP 7, PHP 8.0, and PHP 8.1, will be particularly vulnerable and face a high risk of cyberattacks due to the lack of official security patches.
Are Freebox Routers Affected by the PHP Security Vulnerabilities?
France initially topped a global survey conducted by British cybersecurity company Infowatch, which attributed a significant proportion of exposed PHP services to Freebox routers. However, this finding was based on a technical misidentification: Freebox OS does not run a PHP server and therefore isn’t affected by these two vulnerabilities. This detection error substantially overestimated France’s exposure.
Nevertheless, this situation highlights the importance of keeping connected devices up to date. Free subscribers do not need to take any specific action in response to this PHP security alert. More generally, users should keep their internet routers updated, as their internet service providers distribute any necessary security patches directly.
The Juristique editorial team contacted Gandi, its hosting provider, to ensure that its servers are protected against these PHP vulnerabilities. Gandi confirmed that it is taking the necessary security measures to prevent their exploitation.
