Why you should care if you are an SME or self-employed in the tech sector
If your online business, your e-commerce store or your corporate website uses PHP (Hypertext Preprocessor), what comes next concerns you urgently. PHP is the most used programming language in web development, present in around 70% of sites on the Internet (apnews.com). Two highly serious flaws have been identified, with a score of 9.2 on the CVSS (Common Vulnerability Scoring System) v4.0 scale, which places them in the “critical” category (gub.uy).
These bugs affect basic PHP core functionality and allow attackers to execute remote code without authentication. In practice, they could access your servers or modify your content without you detecting it in time. For this reason, the PHP Foundation has urged that the patches be applied immediately (apnews.com).
Context and technical details of the failures
The official announcement was made on October 20, 2026, when the PHP security team warned that an emergency update would be released the following Tuesday—October 21 at 14:00 UTC—to resolve flaws identified as CVE-2026-109618 and CVE-2026-109619 (discourse.thephp.foundation). Both failures were rated 9.2 out of 10 on the CVSS v4.0 scale (tenable.com)
CVE-2026-109618 (OOM Corruption): Exploits how PHP handles out-of-memory errors. Subsequent cleanup can interpret incomplete data as valid, causing memory corruption and malicious code execution (tenable.com).
CVE-2026-109619 (Stale Global State): This is a use-after-free. Remnants of global state from a previous request can be reused by a worker to execute malicious code in a subsequent request (zaproxy.org).
These vulnerabilities affect all installations that serve web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed, etc. (tenable.com). The informal name for the suite is PHP2Shell (es.wikipedia.org).
Practical implications for small businesses and the self-employed
Exploitations of this type of flaw allow attackers to execute code on your servers without requiring credentials. This means they could insert backdoors, install malware, modify your website or steal information. The scale of the problem is broad: many websites, from standard portals to WordPress, Drupal, PrestaShop or Moodle, may have been affected gub.uy
Organizations such as CISA (US cybersecurity agency) have launched urgent alerts to correct these vulnerabilities or, if this is not possible, isolate the affected systems until the solution is applied (content.govdelivery.com). In Europe and other countries, several national CERTs have issued similar notices elpais.com
Recommended steps to protect your website
We recommend taking the following steps to minimize risks and restore security:
- Identify systems that use PHP: check servers, hosting and components that may be running vulnerable PHP content.govdelivery.com
- Update to patched versions: the versions that fix the bugs are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (content.govdelivery.com).
- If you can't update immediately: Temporarily restrict access from the Internet, use web application firewalls (WAFs) or private networks, and monitor suspicious processes
- content.govdelivery.com
- Restart services after updating: Be sure to restart PHP‑FPM, Apache, etc., otherwise old binaries may continue to operate reddit.com.
- Monitor for indicators of possible exploitation: such as unexpected shells, unauthorized downloads, file modifications or strange behavior content.govdelivery.com
Conclusion
These two critical flaws in PHP – CVE-2026-109618 and CVE-2026-109619 – constitute a real threat to any exposed website. Applying the official patches available from October 21, 2026 must be a priority to guarantee the continuity of your digital activity. At CADT Software, we can help you review your environment, apply updates and reinforce the security of your web applications. Don't let an unpatched vulnerability compromise your project and contact us to act effectively and quickly.
