The team responsible for PHP announced an emergency security update for this Wednesday (21), at 14:00 UTC, intended to fix two critical vulnerabilities. CERT-EU, the European Union's cybersecurity incident response body, warned that the flaws could allow unauthenticated remote code execution, putting servers and applications exposed to the internet at risk.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received a score of 9.2 on the CVSS 4.0 scale, a rating considered critical. In a statement published on Tuesday (20), the PHP maintainers recommended that administrators prepare to install the fixes as soon as they become available.
The alert has potentially broad reach. PHP is used by platforms such as WordPress, Drupal, Joomla, and Magento, as well as online stores, enterprise systems, and hosting services. A successful exploit could allow attackers to execute malicious commands on vulnerable servers, with possible consequences for data and operations.
Given the severity, CERT-EU recommended identifying systems that use PHP and preparing to update them immediately. Organizations unable to apply the fixes should consider temporarily isolating applications exposed to the internet until they can be protected.
According to Reuters, Dane Knecht, Cloudflare's chief technology officer, reported initial signs of attempted exploitation. The company was adjusting its firewall rules to block possible attacks, but stressed that these measures are temporary and do not replace installing the patches.
The Australian Cyber Security Centre (ACSC), in turn, reported that it was not yet aware of active exploitation related to the vulnerabilities. The available reports, therefore, do not allow concluding that widespread attacks are occurring.
Updating WordPress does not mean fixing the server's PHP
One of the main operational risks lies in the difference between updating an application and fixing the environment in which it runs.
WordPress, for example, depends on the PHP installed on the server to run its features. Automatic WordPress updates do not guarantee that vulnerabilities in PHP itself will be fixed, as the security company Wordfence warned Reuters.
This means a site can have WordPress, its themes, and plugins updated and still use a vulnerable version of the PHP interpreter.
For administrators, the initial measure is to identify the PHP version actually used by each application and check who is responsible for maintaining it. In managed hosting, this task may depend on the provider. On their own servers, the update is usually the responsibility of the technical team.
It is also necessary to identify exposed systems, prepare backups, organize a maintenance window, and monitor official announcements to install the fixed versions as soon as they are available. After the update, the operation of the applications should be verified.
Firewalls and temporary access restrictions can reduce exposure while the patches are not applied, but they do not eliminate the vulnerability in the interpreter.
As of the statement reviewed this Wednesday (21), the PHP team had not yet confirmed which versions were affected or disclosed the fixed versions. CERT-EU mentioned the possibility of impact on versions from PHP 5 onward, information that remained without official confirmation.
The definitive identification of vulnerable systems will depend on the technical details expected to accompany the publication of the fixes.
