Critical PHP Bug: What to Do Before the Fix Lands
On the morning of October 21, 2026, I found out about two serious security bugs in PHP, labelled CVE-2026-109618 and CVE-2026-109619. PHP is the technology behind a huge share of the websites on the internet, including WordPress and a lot of online shops. A fix is due on October 21, 2026 at 4:00 pm Central European time. Details of the bugs leaked the day before, so people already know they exist before the fix is out.
What is going on
Both bugs (CVE-2026-109618 and CVE-2026-109619) are rated critical (9.2 out of 10). Exploiting them could let an attacker take control of the server a website runs on. Security firms expect attacks to start very soon after the fix is released. Attackers learn from every fix where the bug is, and they immediately start trying websites that have not been updated yet.
None of this is officially confirmed yet. The official notice should appear on php.net/security. Until then, it is a set of consistent reports from several security sources (links below).
What might work as a fix
The real fix is the new PHP version that comes out on October 21, 2026. As soon as it is available, you need to move to it. On shared hosting that is usually one click in the administration, or the hosting company does it for you.
A temporary safeguard until the fix arrives. According to the leaked description, the bug is connected to a feature that shows the progress of a file upload on a website (technically called session.upload_progress). Most websites do not use it, so switching it off usually breaks nothing. Your website admin or hosting support can set this up, and you may only need to send them that name. It is still only a guess from an unofficial source, though. Nobody has confirmed that it really closes the hole, and it does not replace updating PHP.
Older PHP versions. According to the reports so far, the fix may not be released for very old versions (7 and older, possibly 8.0 and 8.1 as well). If your website runs on one of those, plan on moving to a newer version or switching hosting.
What I did before the fix
- I sorted out what is certain and what is only a guess. What is certain: the bugs exist and the fix is due on October 21, 2026. What is a guess: where exactly the bug sits. One person on Twitter published their own analysis. I treated it as a hint, not a fact.
- I switched off one feature my websites do not need. That is the temporary safeguard described above. Switching it off breaks nothing and can be reversed at any time.
- I checked that the change really took effect. Entering it is not enough. In a few places it did not work at first, even though it looked like it did. Only the check showed that it had to be done differently.
- I wrote a short summary for people who have a website but are not technical. It tells them what to check without making them learn technical terms. I hope this article does the same.
I used Claude to sort out what is safe to do right away and what is still guesswork. It helps to have someone to check facts with at 5:30 in the morning and start acting right away.
What everyone with a website should do
- Ask whoever looks after your website. Write to the agency, developer or friend and ask whether they know about CVE-2026-109618 and CVE-2026-109619 and are dealing with them. It is the fastest step and often all that is needed.
- Check your hosting after 4:00 pm. If you manage the site yourself, find out in the hosting administration which PHP version you use. If a newer one is available, switch to it. If not, ask hosting support when they will roll out the fix.
- Delete old and unused websites. Forgotten test copies are the most common way in for an attacker.
- Keep a current backup of the website. If anything goes wrong, you want something to go back to.
- Check your passwords. The website administration deserves a long, unique password, ideally with two-factor login.
How to tell something is wrong
If your website suddenly behaves oddly, for example it does not open, sends out spam, or shows pages or links you did not put there, contact your hosting or website admin as soon as possible.
No need to panic
This is a normal part of running a website and it is solved with a few steps, as long as they are done quickly. What matters is that someone knows about it and checks it in the next few days.
Sources
The official announcement will be at php.net/security. For now I worked from these unofficial but mutually consistent reports:
