The critical PHP vulnerability affects websites running PHP 5.4 through 8.5.11, and the PHP Foundation's October 21, 2026 fixes patch two remote code execution flaws that can let attackers run code on servers. The flaws are CVE-2026-109618 and CVE-2026-109619. Google Cloud lists patched versions as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The PHP Foundation published the security release on October 21, 2026, after giving advance notice on October 20. Wired reported that the fixes were released just before 10 am ET on Wednesday, and The Verge reported that agencies were urging some sites to go offline if they could not patch immediately. The PHP Foundation says Calif and OpenAI independently reported the same root cause on August 11, Wiz reported further attack vectors on August 24, and OpenAI reported more on September 18.
How the critical PHP vulnerability affects websites
The vulnerability affects websites by turning PHP request handling bugs into remote code execution paths on servers. The PHP Foundation describes CVE-2026-109618 as remote code execution through out-of-memory corruption, with full remote code execution demonstrated on Apache with mod_php under default settings and confirmed on PHP-FPM through application-level code paths. The foundation describes CVE-2026-109619 as remote code execution through stale state, with a use-after-free and worker crash confirmed and remote code execution demonstrated against a real-world application on Apache with mod_php.
These PHP vulnerabilities matter because they sit below applications such as WordPress, Drupal and Adobe's Magento. A site owner may see a CMS issue, but the vulnerable layer is the PHP runtime that processes web requests before the application can protect itself.
Wired quoted Davi Ottenheimer, a longtime security and compliance consultant, describing the attack surface in operational terms: "Most of the web runs on PHP and this bug is in a file upload interface that's like a front door with no lock." He added that an attacker does not need to know which software a site runs, because one crafted upload to a server can be the attack. The PHP Foundation's own advisory language is narrower than the public panic, but its mechanism supports urgent patching because the demonstrated outcome is server-side code execution.
Which systems need action first
The first systems to check are internet-facing servers that run PHP, including CMS, commerce, forums and vendor products that bundle PHP. The UK National Cyber Security Centre says organisations using any version of PHP are affected and should not limit discovery to outdated PHP versions. NCSC's priority actions are to identify PHP systems, monitor third-party vendor updates for bundled PHP, update PHP, apply PHP Team hardening steps and consider taking systems offline when fast update or mitigation is not possible.
- Inventory internet-facing systems that run PHP and record their exact PHP version before deciding that a site is outside scope.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where those versions fit the application and hosting environment.
- For WordPress, confirm who controls the PHP runtime, because The Verge reported that Wordfence warned the fix cannot be installed through automatic WordPress updates.
- If a system cannot update or be disabled immediately, assess it for compromise first and look for attacker-installed backdoors, as NCSC advises.
- If compromise appears, preserve web server and PHP logs before rebuilding or redeploying the affected host.
Cloud users still need to distinguish platform responsibility from application responsibility. Google Cloud says Google Cloud itself is not vulnerable, but users running PHP workloads on Google Cloud may be vulnerable. App Engine standard environment supported runtimes are patched automatically, while users on PHP 8.1 or earlier should upgrade to PHP 8.2 or newer and redeploy. Cloud Run users should rebuild with a patched PHP version and redeploy if automatic base image updates are not enabled or if they deploy their own container image.
Where the evidence is uncertain
The evidence is strongest on the existence of the two CVEs, the patched PHP versions and the demonstrated remote code execution paths. It is thinner on the live exploitation count and the number of affected public sites. The Verge cited a security researcher estimating that more than 1.3 million internet-connected hosts were likely affected and cited WordPress's own claim that WordPress powers more than 40 percent of the internet, while Wired used the broader phrase "millions of systems could be impacted." The primary sources in this evidence do not provide a global count of compromised websites.
Practitioner confusion is also visible, but it should not be treated as technical authority. A post in r/OutOfTheLoop on October 21 asked whether the PHP issue affects services such as Google Drive, Gmail, Yahoo Mail, Firefox, Chrome, Salesforce, Discord, Windows and Reddit. The better answer from the available evidence is narrower: systems are in scope when they run affected PHP to serve web requests, and the evidence here does not establish that those named consumer products are affected.
What search teams should check
Search, paid media and analytics teams should treat this as an availability and integrity incident, not only a server patching ticket. That recommendation is an inference from NCSC's warning about attacker-installed backdoors, Wired's reporting that remote code execution may expose sensitive memory, and the PHP Foundation's demonstrated server-side execution paths. If an attacker can run code on a web server, the practical search risk includes altered templates, changed canonical tags, injected links, modified redirects, cloaked responses and stolen credentials that later affect the CMS or deployment pipeline.
For search visibility, the immediate check is whether important URLs still return the intended content after patching or downtime. Verify status codes, rendered HTML, canonical tags, robots directives, redirects, sitemap freshness and analytics tags on revenue pages before sending paid traffic back to the host.
Paid media teams should review campaigns that send traffic to PHP-backed landing pages before budgets keep running into offline systems. The Verge reported that some agencies encouraged companies unable to patch to isolate internet-facing apps or take them offline, and Wired reported that some government and transport sites were inaccessible during the response. That creates a direct measurement problem: conversion drops, crawler errors and analytics gaps may reflect defensive downtime rather than demand, ranking or bidding changes.
What happens after patching
The next stage is vendor and host follow-through, because PHP can be embedded below products that marketing teams do not administer directly. NCSC says organisations should monitor third-party vendor updates for products that bundle PHP, and Google Cloud separates automatic App Engine runtime patching from customer-managed Cloud Run images. The trigger to watch now is a vendor notice that bundled PHP has been patched, followed by clean web server and PHP logs after redeployment.