Critical PHP Vulnerabilities: What to Do and How to Protect Your Website

Hello, dear Zomro clients! Two critical vulnerabilities have been discovered in PHP that allow attackers to execute code remotely on a server. Websites running PHP, including WordPress, Bitrix, and Drupal, are at risk. We explain what steps you need to take to protect your server and why it is important to update PHP as soon as possible.

What happened?

Two critical vulnerabilities have been found in PHP (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 out of 10). They allow attackers to execute code remotely on a server.

Any website running PHP 5.4 or later in the default configuration is vulnerable, including WordPress, WooCommerce, Bitrix, Drupal, and custom-built projects. Whether the website has file upload forms is irrelevant.

Patches were released on October 21 at 14:00 UTC (16:00 CET). Exploits are already publicly available, and widespread attacks are expected immediately following the patch release.

Before the patch

Take the following steps:

Check the PHP version serving your website in the control panel or by running:
```
php -v
```
If multiple PHP versions are installed on the server, check each one.
Create a backup or a server snapshot.
Enable temporary protection. It reduces the risk but does not fully eliminate the vulnerability:

In php.ini, set:
```
session.upload_progress.enabled = Off
```
For PHP-FPM, use:
```
php_admin_flag[session.upload_progress.enabled] = off
```
Then restart PHP. According to the PHP developers, this setting alone is not sufficient.

Block multipart requests on the web server:

nginx:

if ($http_content_type ~* "multipart") { return 403; }

Apache:

RewriteCond %{HTTP:Content-Type} multipart [NC]
RewriteRule ^ - [F,L]

Warning: File uploads through forms and admin panels will stop working (WordPress media uploads, attachments, imports). Use this measure only if your website can temporarily operate without file uploads.

If your website uses Cloudflare or another WAF, make sure its security rules are enabled. This provides an additional layer of protection but does not replace updating PHP.

After the patch

Update PHP to the patched version for your branch: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later.
If PHP was installed from your distribution's repository (apt/dnf), install the updates as soon as they become available from your distribution. Users of the Remi repository should note that updates may not be available there on the release day.
After updating, restart PHP-FPM and the web server, then check the PHP version again.
Check your website for signs of compromise: unfamiliar .php files (especially in upload directories), new administrator accounts, unknown cron jobs, and unexplained CPU usage spikes.

If you are running PHP 8.1 or older, the PHP developers will not release official fixes for these branches. Plan to upgrade to PHP 8.2 or later (PHP 8.4 is recommended) and test CMS and plugin compatibility on a staging copy first. Keep temporary protection enabled until the upgrade is complete.