---
title: 'Critical PHP Vulnerabilities: What to Do and How to Protect Your Website'
description: 'We explain what steps you should take to protect your server and why it is important to update PHP as soon as possible.'
image: 'https://zomro.com/static/site/images/logo/logo-white.png?v=1792605332'
---

![opened image]()

  * [Zomro](https://zomro.com/)
  * [News](https://zomro.com/blog/news/)
  * Critical PHP Vulnerabilities: What to Do and How to Protect Your Website 



# Critical PHP Vulnerabilities: What to Do and How to Protect Your Website

21-10-2026

**_Hello, dear Zomro clients! Two critical vulnerabilities have been discovered in PHP that allow attackers to execute code remotely on a server. Websites running PHP, including WordPress, Bitrix, and Drupal, are at risk. We explain what steps you need to take to protect your server and why it is important to update PHP as soon as possible._**  


## What happened?

  
Two critical vulnerabilities have been found in PHP (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 out of 10). They allow attackers to execute code remotely on a server.

Any website running PHP 5.4 or later in the default configuration is vulnerable, including WordPress, WooCommerce, Bitrix, Drupal, and custom-built projects. Whether the website has file upload forms is irrelevant.

Patches were released on October 21 at 14:00 UTC (16:00 CET). Exploits are already publicly available, and widespread attacks are expected immediately following the patch release.  


## Before the patch

  
Take the following steps:  


  1. Check the PHP version serving your website in the control panel or by running:
         
         
         php -v

If multiple PHP versions are installed on the server, check each one.

  2. Create a backup or a server snapshot.

  3. Enable temporary protection. It reduces the risk but does not fully eliminate the vulnerability:



  * In php.ini, set:
        
        
        session.upload_progress.enabled = Off

For PHP-FPM, use:
        
        
        php_admin_flag[session.upload_progress.enabled] = off

Then restart PHP. According to the PHP developers, this setting alone is not sufficient.  


  * Block multipart requests on the web server:

nginx:
        
        
        if ($http_content_type ~* "multipart") { return 403; }

Apache:
        
        
        RewriteCond %{HTTP:Content-Type} multipart [NC]
        RewriteRule ^ - [F,L]




  
**Warning:** File uploads through forms and admin panels will stop working (WordPress media uploads, attachments, imports). Use this measure only if your website can temporarily operate without file uploads.  


  * If your website uses Cloudflare or another WAF, make sure its security rules are enabled. This provides an additional layer of protection but does not replace updating PHP.




## After the patch

  1. Update PHP to the patched version for your branch: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later.

  2. If PHP was installed from your distribution's repository (`apt`/`dnf`), install the updates as soon as they become available from your distribution. Users of the Remi repository should note that updates may not be available there on the release day.

  3. After updating, restart PHP-FPM and the web server, then check the PHP version again.

  4. Check your website for signs of compromise: unfamiliar `.php` files (especially in upload directories), new administrator accounts, unknown cron jobs, and unexplained CPU usage spikes.




If you are running PHP 8.1 or older, the PHP developers will not release official fixes for these branches. Plan to upgrade to PHP 8.2 or later (PHP 8.4 is recommended) and test CMS and plugin compatibility on a staging copy first. Keep temporary protection enabled until the upgrade is complete.

Similar articles:

[Tariffs with unlimited traffic and Intel E5-2650v2 and E5-2650v4 processors are here!](https://zomro.com/blog/news/451-tariffs-with-unlimited-traffic-and-intel-e5-2650v2-and-e5-2650v4-processors-are-here) [Warning: Safari changes in 2025 may affect your advertising campaign data](https://zomro.com/blog/news/644-warning-safari-changes-in-2025-may-affect-your-advertising-campaign-data) [Critical PHP Vulnerabilities: What to Do and How to Protect Your Website](https://zomro.com/blog/news/743-critical-php-vulnerabilities-what-to-do-and-how-to-protect-your-website) [Introducing a New Dedicated Server with GPU for Only €92/month!](https://zomro.com/blog/news/641-introducing-a-new-dedicated-server-with-gpu-for-only-92month) [Improvements to the referral program's operation](https://zomro.com/blog/news/187-uluchshenija-po-rabote-referalnoj-programmy)

[ Forex Server from €7.95/mon ](/server-for-forex)