The recent disclosure of two critical PHP vulnerabilities has renewed attention to the importance of website maintenance. On 21 October 2026, the PHP project released security updates addressing CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these vulnerabilities can allow unauthenticated remote code execution, putting affected websites and servers at risk. PHP official security advisory
The US National Security Agency (NSA) also issued an advisory on the same day, recommending that organisations identify systems and services reliant on PHP and prioritise the relevant patches. Where immediate updates are not feasible, the agency recommends taking affected systems offline until the risks can be fully mitigated. NSA official security advisory
The NSA published a PHP security advisory on 21 October 2026, recommending that organisations prioritise patching affected systems. Source: NSA official website.
For website owners, the first step is to confirm the full PHP version actually serving their website. Knowing that a site uses “PHP 8”, or that it continues to load normally, does not establish whether the necessary fixes have been applied.
As of 23 October 2026, the PHP project identifies the following patched versions. The table also shows the security support deadline for each release branch:
| PHP branch | Minimum version patched for these vulnerabilities | Official security support ends |
|---|---|---|
| PHP 8.2 | 8.2.35 | 31 December 2026 |
| PHP 8.3 | 8.3.36 | 31 December 2027 |
| PHP 8.4 | 8.4.27 | 31 December 2028 |
| PHP 8.5 | 8.5.12 | 31 December 2029 |
Version information is based on the PHP official vulnerability advisory and supported versions policy.
These releases contain fixes for the two vulnerabilities discussed here. Organisations should use the latest stable maintenance release within their chosen supported branch, subject to compatibility testing, and continue to apply subsequent security updates. Addressing these vulnerabilities does not establish that every website security risk has been resolved.
Organisations using PHP 8.1 or earlier should give particular attention to upgrade planning, as these branches have reached the end of regular upstream support. Some operating system and long-term support vendors provide backported fixes for older packages. Administrators should therefore confirm coverage for both vulnerabilities with their vendor while planning migration to a supported branch. PHP official update guidance
Support lifetime also matters when choosing an upgrade path. PHP 8.2, for example, reaches the end of official security support in December 2026. Organisations using this branch should plan their next migration alongside the immediate security update. PHP official support schedule
FreeComm provides website security update and maintenance services to help businesses and organisations review their PHP versions and hosting environments, assess patching and upgrade requirements, and plan updates around compatibility and operational needs.
Support can include version reviews, upgrade compatibility assessments, backup and recovery planning, and coordination with hosting providers. Following an update, the team can also assist with checks of key pages, forms and website functions, together with ongoing maintenance planning to make security updates part of routine website management.
To discuss your website’s PHP update requirements or learn more about website security updates and maintenance services, contact the FreeComm team at info@freecomm.com.