Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have triggered urgent warnings from international cybersecurity authorities after researchers discovered two serious security flaws that could allow hackers to take control of vulnerable web servers without needing a username or password.

The vulnerabilities affect PHP, one of the world’s most widely used programming languages for building websites, online platforms and web applications. PHP is used by popular content management systems such as WordPress, Drupal and Joomla, as well as many custom-built business systems.

On Wednesday, 21 October 2026, the PHP development team released emergency security updates to address the vulnerabilities. Organisations operating PHP-based websites and applications have been advised to apply the updates immediately.

The flaws, collectively known as PHP2Shell, have been assigned critical severity ratings of 9.2 under the Common Vulnerability Scoring System version 4.0.

Cybersecurity experts warn that successful exploitation could allow attackers to execute malicious commands, access sensitive information, interfere with website operations or compromise affected systems.

What are the two critical PHP vulnerabilities?

The security weaknesses have been identified as CVE-2026-109618 and CVE-2026-109619.

Both involve problems with how PHP manages memory while processing requests from web users.

CVE-2026-109618 concerns the handling of situations in which PHP runs out of memory during request processing. Under certain conditions, the software may leave internal information in an unsafe state. Attackers could exploit this behaviour to execute unauthorised commands on a vulnerable server.

CVE-2026-109619 involves a different memory management problem. Internal information from an earlier request may remain accessible after the memory supporting it has been released.

This creates an opportunity for an attacker to interfere with subsequent requests and potentially execute malicious code.

The vulnerabilities are particularly concerning because an attacker may not need valid login credentials to exploit them.

In practical terms, a vulnerable web server could be exposed simply by processing specially constructed requests received through the internet.

The level of damage would depend on the permissions available to the affected PHP process and the security controls protecting the server.

Which PHP versions are affected?

The vulnerabilities affect several PHP versions, including older installations that are no longer officially supported.

The PHP development team has released fixes for four supported branches.

PHP version	Fixed security release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Website owners and system administrators using older releases within these branches should upgrade to the corresponding fixed version or a later security release.

PHP 8.1 and earlier versions are no longer receiving security updates directly from the PHP project.

Organisations still using these older versions are advised to move to a supported version or obtain verified security fixes from their operating system or extended-support provider.

The warnings cover PHP installations handling web requests through technologies such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

WordPress and other websites could be exposed

The discovery has serious implications for websites developed using PHP.

WordPress is among the platforms that depend on PHP to process website requests, manage content and support installed plugins and themes.

Although the vulnerabilities are found in PHP itself rather than specifically in WordPress, websites running affected PHP versions could still be at risk.

This means updating WordPress plugins, themes or the WordPress application alone may not resolve the underlying problem.

Website owners must also ensure that their hosting servers are running a patched PHP version.

The same concern applies to businesses operating online shops, school management platforms, customer portals, payment applications and other PHP-based systems.

A website may appear to operate normally while its underlying PHP environment remains vulnerable.

For organisations handling confidential business information, customer records or financial transactions, the consequences of a successful attack could be particularly serious.

International cybersecurity agencies issue urgent warnings

The discovery has prompted warnings from cybersecurity authorities in several countries.

The European Union Agency for Cybersecurity, ENISA, joined other European institutions in advising organisations to identify affected PHP systems and apply the available security updates.

The Canadian Centre for Cyber Security also issued an alert, warning that internet-facing PHP applications face increased exposure.

New Zealand’s National Cyber Security Centre warned on 22 October that it was aware of reports of active exploitation.

The agency encouraged affected organisations to update their systems and investigate signs of unauthorised access.

These warnings reflect growing concerns that attackers could take advantage of the vulnerabilities before website owners and hosting providers complete their updates.

Security researchers have also demonstrated techniques capable of exploiting the weaknesses, making prompt action especially important.

Google confirms the seriousness of the vulnerabilities

Google Cloud has also acknowledged the security issue and advised customers running PHP applications to update their systems.

According to Google’s security guidance, successful exploitation could expose sensitive information or allow attackers to execute commands using the privileges of the affected PHP process.

The company explained that although Google Cloud’s own infrastructure is not vulnerable in the manner described, customers operating vulnerable PHP applications on its services may still be exposed.

This distinction is important because using a major cloud hosting provider does not automatically guarantee that every application deployed on its infrastructure is protected.

Businesses remain responsible for maintaining their applications and ensuring that the software components they use receive appropriate security updates.

Google also advised customers running PHP applications in containers to rebuild and redeploy affected services using patched versions.

What Ghanaian businesses and website owners should know

The security alert is relevant to businesses and organisations in Ghana because many websites and online business systems rely on PHP.

These include corporate websites, educational platforms, customer management systems, e-commerce websites and applications built using PHP frameworks such as Laravel.

Organisations operating such systems should establish which PHP versions are running on their servers and whether their hosting providers have already installed the relevant security updates.

Businesses using shared hosting should contact their providers to confirm that the underlying PHP environment has been patched.

For organisations maintaining their own virtual private servers or dedicated servers, the responsibility may fall on internal IT teams or contracted system administrators.

The risk is especially important for internet-facing applications that process customer information or provide access to internal business services.

However, the discovery of these vulnerabilities does not mean that every PHP website has already been compromised.

Actual exposure depends on the installed PHP version, deployment configuration and the security measures in place.

Security experts recommend immediate updates

Cybersecurity authorities have advised organisations not to delay installing the available fixes.

The first step is to identify PHP installations across websites, servers, containers and applications.

Administrators should then verify whether those installations are running supported, patched versions.

Where possible, systems should be backed up and updates tested before deployment to avoid compatibility problems or unexpected service disruption.

Organisations should also examine server logs for unusual activity, investigate suspicious processes and check for unexpected changes to application files.

Where an immediate update is not possible, limiting public exposure may help reduce risk temporarily. However, cybersecurity authorities have warned that temporary restrictions should not be treated as complete protection.

Applying the security fixes remains the recommended response.

Why these vulnerabilities matter beyond individual websites

The incident highlights the importance of maintaining the underlying technologies on which websites and business applications depend.

Many organisations regularly update the visible parts of their websites while paying less attention to the programming language, server software and supporting infrastructure.

However, a serious vulnerability in one of these underlying components can expose multiple applications hosted on the same system.

The consequences may include service disruption, unauthorised access to information, financial losses and damage to an organisation’s reputation.

For businesses that rely heavily on online services, even a temporary outage can interrupt operations and affect customers.

As more organisations depend on digital platforms, maintaining secure and supported server environments has become an essential part of business continuity.

Website administrators urged to act without delay

With security updates now available, website administrators are being encouraged to review their systems immediately rather than waiting for evidence of an attack.

The PHP development team has made it clear that updating is necessary to address the vulnerabilities properly.

Businesses should also work with hosting providers, software developers and cybersecurity professionals to verify that all affected systems have been patched.

For users of WordPress and other PHP-based platforms, the key message is that website security extends beyond passwords, plugins and themes.

The programming language running behind the website also needs regular maintenance.

As cybersecurity authorities continue to monitor the situation, organisations running vulnerable PHP installations are being urged to make these security updates a priority to reduce the risk of compromise.