Critical PHP Security Update Incoming

A PHP security update was released on Wednesday 21 October 2026. It fixes two critical security vulnerabilities in PHP. A server doesn't get the fix the moment PHP releases it, though. It has to be packaged for that server first.

Most web servers run Linux, a free operating system. Debian and Ubuntu are two of the most popular versions of it. Debian is built by volunteers, and Ubuntu is built on top of Debian by a company called Canonical.

Every server I manage uses Ubuntu. Ubuntu ships one version of PHP per release. To run the latest version, I install PHP from the same source that server tools such as Ploi and Laravel Forge use.

That source is run by the developer who maintains the official PHP packages for Debian, the system Ubuntu is built on. I'll install the fix as soon as the updated packages are out.

What is the PHP security update?

PHP runs on the server and powers most content management systems. WordPress, Drupal and Statamic are all built with it. If your website has an admin area you log into, there is a good chance PHP is behind it.

This update fixes two security flaws in PHP itself. Here is the advance notice the PHP security team gave the day before.

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Upcoming Critical PHP Security Release, php.net, 20 October 2026

The 9.2 is a score out of 10 on the Common Vulnerability Scoring System (CVSS), the standard scale for how serious a security flaw is. That's why I'll install this update as soon as it's available.

On 21 October 2026, no attacks using either flaw had been confirmed.

With the release, PHP confirmed that both flaws could let someone run their own code on a server without logging in. The researchers who found them, at Wiz, call them PHP2Shell.

What I'm doing for sites on my maintenance plans

I'm keeping an eye on PHP's security announcements and the PHP packages my servers use.

PHP's own release is the first step. The fixed PHP is then built for Ubuntu, and as soon as it's out, I'll install it. This is one of the critical patches that can't wait for the monthly update.

Why a Statamic update won't fix it

Statamic is built on Laravel, and Laravel is built on PHP. Most security fixes arrive as a Statamic or Laravel update. This one is in the layer underneath, so the update has to happen on the server.

The same goes for every other website that runs PHP. A WordPress plugin or a Laravel update cannot stand in for it.

This fix happens on the server, not inside your website, so it applies to every site that runs PHP.

Why this PHP update is a little unusual

Normally a security flaw and its fix go public together. The PHP team fixes the problem in private, then publishes the update and the details at the same time.

This time, details of the two flaws leaked online on 20 October 2026, before the fix was ready. PHP gave advance notice of the release that evening, so hosts and developers could prepare.

If you see them mentioned elsewhere, they're listed as CVE-2026-109618 and CVE-2026-109619. A Common Vulnerabilities and Exposures (CVE) number is the public reference every security flaw gets.

What if I don't look after your website?

If your website runs on PHP and someone else looks after its server, ask them when they plan to install the update. It's worth running any other updates now, so the PHP fix is the only job left when it arrives.

Where the fix comes from depends on where your server gets PHP. If it uses Ubuntu's own PHP, the fix arrives as an Ubuntu update from Canonical. If it uses the same PHP source as Ploi and Laravel Forge, as many servers do, the fix comes from there. Whoever looks after your server will know which.

If your site is hosted on one of Laravel's own platforms, Cloud, Forge or Vapor, the Laravel team said on 21 October 2026 that it was working out how to get the fix out quickly.

PHP released fixed versions for the releases it still supports, 8.2 to 8.5. For 7.4 to 8.1 it only published the code changes, which hosts would have to build themselves. If you are on one of my maintenance plans, your site will be running a supported version of PHP and will get the update.

A site on an older version of PHP may not get a fix at all. For a site like that, a move to a new server is the way out.