AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
Generated stack · The PHP Group

PHP

Server-side runtime behind WordPress, Laravel and most shared hosting.

1Advisories
1critical
0high
0medium
2026-10-21Latest
PHP CVEs & security

Is PHP safe?

PHP runs WordPress, Laravel and most shared hosting. A flaw in the PHP runtime affects every site on it, whatever the code was written with.

We track 1 security advisory that affects PHP. By severity: 1 critical. It has a CVE ID. It is a code execution issue. The newest entry is dated 2026-10-21.

Newest entries on this page
Using PHP safely
  • Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then restart PHP-FPM or your web server workers so the new version is loaded.
  • On shared hosting, check the PHP version in your control panel or with php -v, and ask your host if it is behind.
  • A WAF can block known exploits, but it does not replace upgrading.
Timeline · advisories per quarter
12026 Q4
Named in sources

Reported for PHP

01. criticalCode executionphp2shell (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution in PHP itselfTwo bugs in how the PHP runtime cleans up memory after a request ends abnormally can let an unauthenticated HTTP request run code as the web server's PHP worker. They affect every PHP install that serves web requests (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, and Cloudflare's WAF blocks known exploits by default, including on the Free plan. PHP Replit 2026-10-21
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.