Does this affect your website? Very likely. PHP runs a large share of the web, close to 70% of sites by some estimates, including countless WordPress blogs and online shops. On Wednesday, 21 October 2026, the PHP security team shipped emergency releases fixing two critical vulnerabilities that let an attacker with no login run code on a server remotely. Both are rated 9.2 out of 10 on the CVSS v4.0 scale and are tracked as CVE-2026-109618 and CVE-2026-109619.
Which version do you need? PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and the project tells all users to update immediately. Every PHP installation that serves web requests is in scope, whether it runs through PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP or LiteSpeed. The team rates mod_php as the highest risk, because a working exploit there fires before any application code runs.
What if you are on shared hosting? Ask your host which PHP version your site uses and when it will be patched. Linux distributions and long-term support vendors received the fixes ahead of release, and many have already published updated packages.
And sites still on old versions? PHP 8.1 and earlier no longer get updates from the project. Given the severity, the team did publish minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves, but moving to a supported release remains the safe route. PHP 8.2 itself reaches end of life on 31 December 2026.
Can a configuration change replace the update? No. The advisory lists stopgaps, such as lowering post_max_size and setting session.upload_progress.enabled to 0, but says they only narrow certain attack paths and do not make a server safe. On 23 October the team added a further notice recommending that same session setting be switched off until the next bugfix release.
Why is CNBC calling it "Black October"? Researchers at Wiz and Calif found the flaws with help from AI models, and once warnings spread this week, governments and companies rushed to patch. France's Interior Ministry put all its websites into preventive maintenance, and Amazon's security team says it caught an exploitation attempt against one of its honeypots on 17 October, four days before disclosure.
