On Oct 21, 2026, the PHP project shipped fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2, and both can let an attacker run their own code on a web server. If your website or online store runs on PHP, you need to know your version today.
Which PHP versions have the fix
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
PHP 8.1 and older get no fix from the PHP project. CISA advised taking PHP systems offline if they cannot be patched right away. Cloudflare turned on protection for all of its WAF plans, including the free plan.
PHP also suggests turning off session upload progress until its next regular release, to block one unlikely attack path. Most sites do not need to act on this.
How to check your PHP version
Log in to your web host control panel. Most hosts show the PHP version on the main hosting page or a page called PHP settings.
If you run your own server, open a terminal and run php -v. The first line shows the version.
A developer can also call the built-in phpversion function from any PHP file. Delete any test file when you are done, so strangers cannot see it.
Compare what you see with the list above. If your version is lower than the fixed one in its line, ask your host to update it, or update it yourself.
What if I am on PHP 8.1 or older
There is no fix from the PHP project for those versions. Plan a move to a supported version. The PHP supported versions page lists which ones still get security fixes.
FAQ
Do I need to do anything if my host manages PHP for me? Ask them to confirm you are on a fixed release. Do not assume it happened.
Does a firewall replace the update? No. Cloudflare's rules add a layer of protection, but the update is the real fix.
Sources
PHP news archive, Oct 21, 2026
CISA alert, Oct 21, 2026
Cloudflare blog, Oct 21, 2026
PHP manual: phpversion, checked Oct 24, 2026
PHP supported versions, checked Oct 24, 2026
Want an AI helper that watches for fixes like this for you? The Grok Bot Pro Pack has ready setups for real work.
Get Factwire free every Monday and Friday.