---
title: The PHP emergency requires patching and verifying website security
description: Critical PHP vulnerabilities require urgent patching. Learn essential actions for securing web applications and maintaining business continuity in this advisory.
---

[Internet Security Auditors Blog](https://blog.isecauditors.com/en)

# [The PHP emergency requires patching and verifying website security](https://blog.isecauditors.com/en/the-php-emergency-requires-patching-and-verifying-website-security)

 Written by [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) | Oct 22, 2026, 7:29:01 AM

Madrid, 21 October 2026. Two critical vulnerabilities in PHP, a technology used by many web applications, have triggered an urgent response. Several European organisations have taken services offline as a precaution. These preventive interruptions do not establish that their systems were compromised. Patches are now available and should be applied and verified promptly. \[1–3, 8\]

The flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; organisations using distribution packages should confirm the equivalent fix with their vendor. Updating WordPress, its plugins or another content management system alone does not ensure PHP is patched. \[1–2\]

At Internet Security Auditors, we recommend identifying all services that depend on PHP, including outsourced hosting, containers and third-party applications, and assigning update owners. Prioritise internet-facing assets, check compatibility and verify that every running process uses a fixed version. Older branches require confirmation of vendor coverage or a migration plan. \[1–2\]

If immediate patching is impossible, consider temporary isolation and activate continuity arrangements for essential services. Partial mitigations do not replace updates. We also recommend preserving and reviewing logs, investigating signs of intrusion, and testing backup restoration and recovery. Patching prevents further exploitation but does not itself remove an existing compromise. \[1–2\]

At Internet Security Auditors, we turn these actions into verifiable controls through web application audits, authorised penetration testing and system configuration reviews. We complement assessments with forensic analysis and business continuity and disaster recovery consultancy (BCP/DRP), helping organisations prioritise risks, verify fixes and prepare a secure recovery. \[4–7\]

<https://www.isecauditors.com/>

References

\[1\] PHP — Official advisory and fixed releases (21 October 2026)  
[https://www.php.net/archive/2026.php](https://www.php.net/archive/2026.php)

\[2\] CERT-EU — Security advisory 2026-018 and recommendations (21 October 2026)  
[https://cert.europa.eu/publications/security-advisories/2026-018](https://cert.europa.eu/publications/security-advisories/2026-018)

\[3\] Reuters — Precautionary website shutdowns following PHP flaws (21 October 2026)  
[https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/](https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/)

\[4\] Internet Security Auditors — Web Application Audits  
[https://www.isecauditors.com/en/web-application-audit](https://www.isecauditors.com/en/web-application-audit)

\[5\] Internet Security Auditors — System Hardening  
[https://www.isecauditors.com/en/systems-hardening](https://www.isecauditors.com/en/systems-hardening)

\[6\] Internet Security Auditors — Digital Forensics  
[https://www.isecauditors.com/en/computer-forensics-and-expert-reports](https://www.isecauditors.com/en/computer-forensics-and-expert-reports)

\[7\] Internet Security Auditors — Security and Business Continuity Consultancy  
[https://www.isecauditors.com/en/security-consulting](https://www.isecauditors.com/en/security-consulting)

\[8\] WIRED — Coverage of the PHP security emergency (21 October 2026)  
[https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire](https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire)

 

[View full post](https://blog.isecauditors.com/en/the-php-emergency-requires-patching-and-verifying-website-security)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Alberto Villar Arévalo"
  },
  "dateModified" : "2026-10-22T07:29:01.048Z",
  "datePublished" : "2026-10-22T07:29:01Z",
  "headline" : "The PHP emergency requires patching and verifying website security",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1024,
    "url" : "https://25534193.fs1.hubspotusercontent-eu1.net/hubfs/25534193/vulnerabilidades-php.png",
    "width" : 1536
  },
  "mainEntityOfPage" : "https://blog.isecauditors.com/en/the-php-emergency-requires-patching-and-verifying-website-security",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```