%201.svg)
Two Critical PHP Vulnerabilities: What Business Owners Need to Know and Do Now
Newly disclosed security flaws could expose vulnerable websites to remote attacks. Here's what you should check and how AICISO is responding.
On October 21, 2026, the PHP security team announced two critical vulnerabilities that could allow attackers to execute malicious code on vulnerable web servers without needing to log in.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both carry a critical severity rating of 9.2 under CVSS v4.0.
For businesses that depend on their websites and web applications, these vulnerabilities deserve immediate attention. The good news is that security updates are already available. The important thing now is to determine whether your systems are affected and make sure those updates are applied.
Why These Vulnerabilities Matter
PHP is one of the most widely used programming languages for web development. It powers everything from small business websites and blogs to complex business applications.
Both vulnerabilities affect how PHP handles certain internal operations during web requests. Under vulnerable conditions, an attacker could potentially exploit these flaws to execute malicious code on the server without authentication.
This is known as remote code execution (RCE), and it's particularly serious because a successful attack could compromise the systems supporting a website or application.
The PHP security team has identified installations serving web requests as potentially at risk, including environments using PHP-FPM, Apache, and other common configurations.
However, not every website is automatically vulnerable simply because it uses PHP. The installed version, security patches, and server environment all matter. 
The Fix Is Available, but Someone Has to Apply It
The PHP development team has released security updates addressing both vulnerabilities.
The patched releases are:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Organizations running older PHP versions should contact their hosting provider or software vendor to determine whether supported security fixes are available or whether an upgrade is necessary.
The PHP security team has made one thing clear: upgrading to a patched version is the only complete fix.
Temporary measures may reduce exposure to certain attack methods, but they do not eliminate the underlying vulnerabilities.
What Business Owners Should Do Now
You don't need to understand PHP programming to take the right next steps. But you do need to know who is responsible for maintaining the technology behind your website.
We recommend asking your website developer, hosting provider, or IT team these questions:
- Does our website or any business application use PHP? Identify the systems that may be affected, including applications maintained by third parties.
- What PHP version are we running? Confirm whether the installed version has received the appropriate security update.
- Has the fix been applied? Ask for confirmation that the update was successfully installed, not simply scheduled.
- Are our other web-facing systems being checked? Websites are not always the only applications using PHP.
- Are we monitoring for suspicious activity? Make sure relevant security logs and alerts are being reviewed.
If you don't know the answers, now is the time to ask.
What AICISO Is Doing for Our Customers
At AICISO, we're taking an active approach to identifying potential exposure.
Our team is reviewing scan targets and verifying results across customer assets on the AICISO platform. We are working to complete vulnerability scans across those assets by the end of October 22, 2026.
If we identify either vulnerability, we will reach out directly to the designated point of contact for the affected customer account.
It's important to understand that vulnerability scanning helps identify potential exposure, but the underlying PHP installation still needs to be updated. We're recommending that customers contact their website developers or maintainers to confirm their PHP versions and apply the necessary fixes.
Cybersecurity Requires More Than Knowing About the Risk
This disclosure is another reminder that cybersecurity isn't just about having the right tools. It's also about knowing what technology your business depends on, identifying vulnerabilities, and making sure someone is responsible for addressing them.
For many small and midsize businesses, websites and applications are maintained by outside providers. That's perfectly reasonable, but outsourcing the work shouldn't mean losing visibility into whether critical security updates are being applied.
Knowing about a vulnerability is the first step. Making sure it gets fixed is what protects your business.
If you have questions about these PHP vulnerabilities or want to discuss what they may mean for your organization, visit AICISO. We have a team ready to help answer your questions.
