Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
Can anything be done to fix it, or do we just have to wait for updates?
How it was asked: In a group chat on the morning of 22 October, under a link to The Times' story 'Race to fix PHP security issue in software behind most websites'.
The short answer
The updates already exist: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October and fix both flaws. Nobody is waiting on PHP; the wait is for whoever runs each server to install them and restart. If that is you, update now; if you cannot today, there are temporary settings and, as a last resort, taking the site offline. If a hosting company runs your site, ask them whether it is patched.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/fix-or-wait/index.html
What it means for you
| If | Then |
|---|---|
| you run your own server or VPS | update the PHP package, restart PHP-FPM or Apache, check php -v where the code actually runs. |
| a hosting company or agency runs your site | ask them in writing whether PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distribution backport) and when the workers were restarted. |
| you use a hosted service such as a shop platform or a SaaS product | there is nothing to install; the provider patches. Check its status page. |
| you only visit websites | there is nothing to update on your computer or phone for this one; the flaw is on web servers. |
The answer, with its sources
The fix is out. The PHP project released fixed versions on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. php.net says All PHP users are strongly encouraged to update immediately
, and that only an update is a complete solution. php.net CVE record CVE record php-src
So the wait is not for PHP, it is for whoever runs the server. Installing the package is not enough on its own: every PHP worker has to be restarted and every container image rebuilt, and the running version checked afterwards. Linux distributions ship their own backported packages; at least one third-party repository had none on release day. php.net BACS NCSC-NL
If you cannot update today, php.net lists temporary settings that each block a known attack path (for example session.upload_progress.enabled=0, a low post_max_size, and on 8.5 fatal_error_backtraces=0). Its own words: they reduce exposure to specific attack paths but do not make an installation safe
. php.net PHP
A web application firewall in front helps, and is not enough. Cloudflare, Akamai, Fastly, Imperva and Fortinet shipped rules, and every one of them calls it a stopgap and says patch anyway. Cloudflare Akamai Security Research Fastly BACS
If none of that can be done in time, the NSA, CISA and the UK NCSC say take the system offline until it is fixed. That is the last step on every agency's list, not the first. NSA Cyber on X CISA NCSC UK
Two exceptions. PHP 8.1 and older get no release: the project published source backports for 7.4, 8.0 and 8.1, so for those the answer is a migration plan, or a vendor that backports. And a report that the 8.5.12 fix may be incomplete appeared on the oss-security list within hours and has not been answered there, so keep watching for a follow-up release. php.net php-src oss-security
The pages that carry it
- If you run PHP: the steps, in order, with their sources
- The two flaws: CVE-2026-109618 and CVE-2026-109619
- Detection and defence: what blocks php2shell and what shows it
- Affected systems: versions, deployments, applications, inventory
- Briefing for a developer: Is my code the problem, what do I change, and how do I check the box I deployed to?
Next question: Is PHP really the software behind most websites? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.