PHP Vulnerabilities | October 2026
Fixes are now available for two critical remote code execution vulnerabilities in PHP. Here's what you need to know.
What’s happening
PHP is a free programming language that runs behind the scenes on many websites and web applications. It powers popular platforms such as WordPress, Drupal, Joomla and Magento, as well as hosting services, website control panels and business software. Many organizations use PHP without knowing it because it often comes built into products from other companies.
On October 21, 2026, the group that maintains PHP released fixes for two critical security flaws. The flaws (CVE-2026-109618 and CVE-2026-109619) could allow an attacker to take control of a web server over the internet without a username or password; this is called remote code execution (RCE). PHP rates both flaws as critical, and information about them leaked before the fixes were released.
What this means for your organization
Any PHP installation that serves web pages and has not been updated is at risk. An attacker could run commands with the same access the website has. Depending on what that server can reach, this could lead to stolen data, website tampering or a foothold for further attacks. One of the flaws may also let an attacker read information held in the server’s memory such as passwords, access tokens and application programming interface (API) keys.
What to do now
If your organization, or a vendor you rely on, uses PHP, ask your IT team or provider to update it as soon as possible. If you are unsure whether PHP is in use, contact your IT team or provider to confirm.
- Send this article to whoever manages your website, web hosting or IT, including any outside IT provider.
- Ask them to confirm whether PHP is in use, and if so, update the software. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later. If PHP is packaged by a Linux provider, hosting company or software vendor, ask that company to confirm the fix is in place.
- If you run PHP 8.1 or earlier, ask your IT team or provider about a vendor-supplied fix, or upgrade to a supported version. These versions no longer receive official updates from the PHP development team. Limiting internet access to the affected system can help reduce risk in the meantime.
If you can’t update right away, PHP lists temporary measures on its website. These measures help reduce risk but do not make an installation safe. Updating is the only complete fix, and doing so promptly is the most effective way to reduce your risk from these flaws.
If you notice unusual activity on a web server, such as unfamiliar files or unexpected programs running, save your server logs and report it to the Travelers Claim team via the email address or hotline number found on the declarations page of your policy.
PHP Resources
For the full list of affected versions and temporary measures, see the PHP security announcement. Updated versions are available on the PHP downloads page.
