PHP is shipping an emergency fix for two critical flaws tomorrow. If you run a website, get ready now.

What was announced

On October 20, the PHP security team gave advance notice of a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, each rated CVSS v4.0 9.2. The team said all PHP users should prepare now so they can upgrade as soon as the release is available, and that it reserves the right to release earlier if details become public or exploitation is seen. Wordfence relayed the notice to WordPress site owners the same day.

The two issues are tracked as CVE-2026-109618 and CVE-2026-109619. Both are described as remote code execution in PHP itself, not in a plugin or a framework. Details leaked ahead of the embargo; security researchers who have seen them report that every PHP version from 5 onward appears to be affected, though PHP has not confirmed the affected versions. No exploitation in the wild has been reported as of this writing.

Who this affects

Anyone running a PHP application, which is most of the web: WordPress, Joomla and Drupal sites; ownCloud and Nextcloud file servers; SuiteCRM and other PHP business apps; Laravel and Symfony applications; phpMyAdmin; webmail such as Roundcube; and most hosting control panels. If your business has a website, there is a good chance PHP is behind it.

What to do today, before the fix

1. Find out what runs PHP for you and who is responsible for patching it. On managed hosting (WordPress hosts, cPanel, Plesk), that is your provider. On your own servers, it is you or your IT provider. Decide that now, not tomorrow.
2. Check your PHP version. In WordPress: Tools → Site Health → Info → Server. In cPanel or Plesk: the PHP selector. On a server: php -v. Write it down so you can confirm the change after patching.
3. If you are on PHP 8.0 or older, plan an upgrade regardless. Those branches no longer receive security fixes from the PHP project. Some Linux distributions backport fixes, but a site on PHP 7 or older is unlikely to get one.
4. Ask your host or provider when they will apply it. A good answer is "within hours of release". A vague answer is a reason to follow up tomorrow.
5. Make sure you have a current backup of the site files and database, so a bad patch or a successful attack can be reversed.

What to do tomorrow, once the fix is out

1. Update to a fixed version from your distribution or PHP repository, then restart PHP-FPM or Apache. Confirm the version changed.
2. Don't rely on a web application firewall alone. A WAF rule can narrow exposure while you patch, but it is not a substitute for the fix.
3. Watch for signs of exploitation in the days after: unusual POST requests in web logs, new files in upload or temp directories, unexpected admin users. If something looks wrong, treat the host as compromised until proven otherwise.

What we are doing

We inventoried every PHP installation we manage today: WordPress hosts, EFAdrive file-sharing servers, our CRM, and our own websites. Each one has a prepared, tested update path and will be patched as soon as its vendor publishes the fix. Managed customers do not need to do anything; we will update this page and note the change in your next service report.

Where EFA fits

• EFAshield tracks pending security updates across every server it watches and alerts when a host falls behind, which is how we knew within minutes which systems need this fix.
• Not a customer? Sign up for alerts and you will get the update to this advisory by email, or ask us to check your exposure.

Sources: PHP security team pre-announcement, php.net, October 20, 2026; Wordfence PSA, October 20, 2026. Summary by the EFA Security team. This page will be updated after the release.