XANTEC Solutions is informing customers about a critical PHP security vulnerability 2026 issue affecting PHP, the programming language that powers a large share of websites and web applications.
On 21 October 2026, the PHP security team released updates for two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. These flaws sit in the PHP runtime itself. An unauthenticated attacker who can reach a vulnerable web-serving PHP installation may be able to execute malicious code by sending specially crafted requests.
Successful exploitation could compromise an affected website or application and expose data handled by that server.
The Malaysian National Cyber Security Agency (NACSA), through the National Cyber Coordination and Command Centre (NC4), issued advisory NC4-ALR-2026-000011 on 22 October 2026, urging organisations with internet-facing PHP systems to patch immediately.
Which Systems Are Affected?
These vulnerabilities affect the PHP runtime, not only one website platform. Exposure depends on the PHP version, how PHP is executed, the server configuration, and the application environment.
Official guidance states that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project treats Apache mod_php as the highest-risk setup.
The official patched releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older versions no longer receive security updates from the PHP project. Some operating-system and hosting vendors supply backported fixes. Websites still running unsupported PHP, including PHP 5.6 and other end-of-life branches, need urgent attention because they will not be patched by the PHP project itself.
A website may continue to function normally while remaining vulnerable. The absence of visible errors or suspicious activity does not mean a system is secure.
What Should Website Owners Do?
1. Identify the PHP Version
Check the PHP version used by every website and application, including systems on shared hosting, VPS, and dedicated servers. Confirm the version that actually serves web requests, not only a default or unused package on the same server.
2. Upgrade to a Patched PHP Version
Upgrade to an official patched release listed above, or to a verified security-patched package supplied by the operating system or hosting vendor.
The PHP version must be supported and compatible with the application. Changing the PHP version alone does not resolve every security issue, and an unpatched older package can still be vulnerable even if the site appears to run.
3. Review Legacy Applications
Older websites and custom applications may need development work before they can run on a supported PHP version.
Create a staging environment, identify incompatible code and dependencies, test critical functionality, and deploy the upgrade only after appropriate validation.
4. Apply Temporary Protective Measures
If an immediate upgrade is not possible, restrict access to the affected application where you can, apply network-level controls, and review server logs for unusual activity.
The PHP project has published temporary configuration measures that reduce exposure to specific attack paths. Those measures do not make an installation safe. A Web Application Firewall (WAF) may add another layer of protection, but it is not a replacement for the required security updates. If adequate protection cannot be implemented, temporarily taking the affected system offline may be necessary.
5. Check for Possible Compromise
For systems that were exposed while vulnerable, review relevant logs and inspect for unexpected file modifications, suspicious scripts, and other indicators of compromise.
Installing a security update does not remove malware that may already have been installed.
How Can XANTEC Assist?
XANTEC Solutions provides website maintenance, custom software development, and hosting-related technical services.
If your website or application is running an outdated PHP version, we recommend arranging a technical assessment to determine its current exposure, compatibility requirements, and upgrade options.
Depending on the system, the work may include PHP compatibility assessment, application code updates, staging tests, server configuration changes, and security hardening.
Upgrading PHP does not automatically make an incompatible application work correctly. Legacy systems may need additional development and testing before the upgrade can be deployed safely.
If you are unsure which PHP version your website is using, contact your website developer or hosting provider to verify it and arrange the appropriate remediation.
Official Security References
- PHP security advisory, 21 October 2026: https://www.php.net/archive/2026.php
- NACSA / NC4 advisory NC4-ALR-2026-000011: https://www.nc4.gov.my/alertAdvisory-detail/NC4-ALR-2026-000011
- cPanel security advisory: https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619
This advisory is provided for security awareness and general guidance. The appropriate remediation depends on the PHP version, hosting environment, and application configuration.