PHP security alert: two critical vulnerabilities put websites and servers at risk. Urgent updates required

On 21 October 2026, an important cybersecurity alert was issued concerning PHP, one of the most widely used programming languages in the world for developing websites and online applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been classified as critical and may allow remote code execution (RCE) without the need for authentication.

In practical terms, a malicious actor could exploit these flaws to compromise a vulnerable server, run unauthorised commands, access confidential information or install malicious software.

The seriousness of the situation has led to advisories being published by major national and international cybersecurity bodies, including the UK National Cyber Security Centre (NCSC) and Italy's CERT-AGID.

Which websites and applications are at risk?

The vulnerabilities directly affect PHP and not a specific CMS or software product.

As a result, websites and applications based on the following may be affected:

• WordPress and WooCommerce, used for business websites, portals and e-commerce.

• PrestaShop, one of the most widely used e-commerce platforms.

• Joomla and Drupal, used for content management and portals.

• XenForo, software designed for building forums and communities.

• Laravel and custom PHP applications, used for management systems, business platforms and online services.

The problem may also affect infrastructures that use Apache, Nginx with PHP-FPM, LiteSpeed and other PHP execution configurations.

Please note: updating WordPress, PrestaShop or another CMS is not enough. The vulnerability affects the PHP engine installed on the server, which must be updated or patched directly.

Which PHP versions need to be updated?

On 21 October 2026, the official PHP team released four new versions that fix the vulnerabilities:

Installations that use PHP 8.1 or earlier versions also require particular attention, as these branches are no longer officially supported.

Some Linux distributions and service providers may distribute security fixes through dedicated packages, without necessarily changing the main version number. It is therefore important to verify that the patches have actually been applied, rather than simply checking the version number shown in the hosting control panel.

The risk is not merely theoretical: tools to exploit the vulnerabilities are available

The situation is particularly sensitive because proof-of-concept tools and techniques for exploiting the vulnerabilities have already been made public.

Cybersecurity authorities have warned of the risk of attacks on systems exposed to the internet and, in some cases, reports of exploitation attempts already under way.

The existence of public exploits increases the likelihood that even attackers with limited technical skills may attempt to compromise systems that have not been updated.

A vulnerable server could be used to steal data, compromise hosted websites, alter content, install backdoors or carry out further malicious activity, depending on the configuration and the privileges available.

What should businesses and website administrators do immediately?

The priority is to check the PHP version in use and make sure that the security fixes have been installed.

It is also advisable to:

1. Check all websites and PHP services, including those hosted on dedicated servers, VPS and shared hosting.

2. Apply security updates, first checking application compatibility.

3. Review system logs and access records to identify any suspicious activity.

4. Verify the integrity of files, applications and configurations, ruling out the presence of unauthorised changes.

5. Check the security of data and backups, especially where personal, commercial or confidential information is involved.

It is essential to stress that installing an update does not guarantee that a previously vulnerable server has not already been compromised.

Where there are signs of an attack, a security analysis should also be carried out to identify any unauthorised access, file modifications and persistence mechanisms.

Leonardo Network: support for urgent updates and security checks

Leonardo Network S.r.l. offers its expertise in software development, server administration and cybersecurity to help businesses and professionals manage this emergency.

We can work on websites, e-commerce sites, custom applications and server infrastructures to carry out:

• Checks for vulnerabilities and installed PHP versions.

• Updates and application of security patches, with compatibility checks.

• Analysis of potentially compromised servers and applications, through technical checks and analysis of the available logs.

• Detection of malware, backdoors and unauthorised modifications.

• Clean-up and restoration of compromised systems, depending on the conditions found.

• Securing and hardening of infrastructures, to reduce the risk of further attacks.

Do you have a PHP website or server? Contact us now.

If you do not know which PHP version your website uses, are unable to apply the updates or suspect that your server has already been breached, contact Leonardo Network to request a technical check and a security intervention.

Do not wait for a security problem to turn into a service outage, data loss or a compromise of your company's infrastructure.

Contact Leonardo Network

Official sources

• PHP – Security advisory and updates of 21 October 2026

• NCSC UK – Critical security issue affecting PHP

• CERT-AGID – Two critical vulnerabilities in PHP

• CERT-EU – Critical Vulnerabilities in PHP