The man who saved the internet this week

On 21 October 2026 the PHP project shipped an emergency security update. It fixes two critical flaws (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). Both let attackers run their own code on a server without logging in. That includes WordPress, Joomla, Magento, Nextcloud and many other systems built on PHP.

What happened?

• It started in 2004. Security researcher Stefan Esser described a problem in PHP’s memory handling: if the memory limit is hit in the middle of an operation, data is left half-built, and the cleanup code trusts it anyway.
• It came back in 2020 and 2024. A partial fix landed in 2020. A 2024 security audit found the weakness again but could not prove it was exploitable.
• The release came a day early. Disclosure was planned for Thursday, 22 October. On 20 October the key details (CVE numbers, rating, date) leaked on Hacker News, so the PHP project published the update on Wednesday, 21 October.
• Attacks started straight away. Cloudflare reported first attacks before the update was out, and attempts rose sharply afterwards. According to Amazon, isolated attempts were already seen on 17 October.

The man behind the updates

Most Linux servers don’t get PHP straight from the PHP project but as a ready-made package. For Debian and Ubuntu, those packages have been built for more than 20 years by Ondřej Surý from the Czech Republic, in his spare time and funded by donations. His day job is leading DNS development at the Internet Systems Consortium.

Thanks to his packages, many admins could update their servers with a single command instead of compiling PHP themselves. He also ships the fix for old PHP versions (back to 5.6) that the PHP project no longer maintains. Remi Collet runs a similar service for Red Hat-based systems (CentOS, AlmaLinux).

The case shows a familiar problem: a large part of the internet depends on the work of individual volunteers, while companies reap the benefits.

What should you do now?

1. Check your PHP version. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer are safe.
2. Update now. On Debian/Ubuntu with Surý’s packages, a normal system update is enough. On shared hosting, ask your provider whether the update is installed.
3. Retire old PHP versions. PHP 8.1 and older no longer get updates from the PHP project. Plan the move to a current version.
4. Check your server for anything unusual. If you updated late, review logs and changed files.
5. Don’t try untested exploits. According to Surý, a “proof of concept” doing the rounds is not verified.

For what the flaws mean technically, see our post Critical PHP vulnerabilities: why you should update your website today.

Not sure whether your WordPress site is affected? I’m happy to check it for you.

Sources: PHP2Shell (Wikipedia) · Sansec · Patchstack · CNN · Hackaday · Stefan Esser, Advisory 2004 · bluewin.ch

Read next

• NewsCritical PHP vulnerabilities: why you should update your website today
• AutomationClaude Cowork vs ChatGPT Work: agentic work compared
• AutomationAI knowledge base: NotebookLM, Claude Projects or custom RAG?