Abstract:
The PHP security team has just issued an emergency security alert. The team will release an emergency security update to fix two high-risk security vulnerabilities at 22:00 on October 21, 2026. The official details of the vulnerability have not been announced yet, but according to the news circulating on the Internet, the old version of PHP has a remote code execution vulnerability, and only the default installation configuration is needed to trigger the vulnerability.
The PHP security team stated that it is recommended that all users upgrade to the latest version immediately after the update is released. The affected version, repair version and some details will be announced after the new version is released. The official also stated that if the details of the vulnerability are disclosed in advance or evidence of wild exploitation emerges, it is not ruled out that a repaired version will be released in advance.
The currently known vulnerability numbers are CVE-2026-109618 and 109619, and the vulnerability scores are both 9.2. According to the repair plan, the PHP team will only provide security updates for the PHP 8 series. Older versions such as PHP 5.6 and 7.x will not be able to receive updates. It is not known whether there will be a mitigation solution by then.
PHP is highly used, but many websites are still using older versions that have been discontinued. Cyberspace Insights data shows that approximately 59.4% of the 1.5 million exposed PHP hosts are using older versions of PHP that are unable to obtain updates. When the new version is fixed, core vulnerabilities may soon be discovered by hackers and launched attacks.
Therefore, a large number of websites may be attacked due to PHP vulnerabilities. This incident is extremely harmful. It is recommended that users using PHP pay attention to the version update released at 10 o'clock in the evening. If necessary, they can even shut down in advance to wait for the update.
Comments