Critical PHP security update: what local businesses need to do this week
Cloudflare reported it was “seeing early attacks emerging” ahead of the release, and security firm Sansec warned that mass exploitation could begin within minutes of the patches going public.
What happened
Cloudflare told WIRED it saw attack traffic aimed at its customers before the patches shipped, and Sansec wrote ahead of the release that it expected mass attacks to start within 15 minutes.
Update, October 22, 2026
CloudLinux has published a technical breakdown of the PHP release with practical guidance for hosts and site owners. Key points for local business websites:
- CloudLinux confirms that “PHP released fixes for both critical vulnerabilities (CVSS v4.0 9.2): 8.5.12, 8.4.27, 8.3.36, and 8.2.35.” CloudLinux also notes that “Per PHP, all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Risk is highest for mod_php.”
- For sites on cPanel with EasyApache 4, CloudLinux states that “Fixed ea-php packages for cPanel EasyApache 4, ea-php52 through ea-php85, are released.”
- CloudLinux reports that “Imunify360 with the WAF enabled receives rulesets 8.83 to 8.85 automatically. On ModSecurity (Apache and Nginx) and Coraza, they block the known exploit requests and the public exploit tool,” and that on LiteSpeed, ruleset 8.84 added blocking rules for the public tool and for upload progress requests that do not come from the site’s own pages.
- CloudLinux calls the WAF coverage a virtual patch, not a fix: “This is a virtual patch: it stops known request patterns at the server edge while the vulnerable PHP code stays as it is.”
- CloudLinux advises Imunify360 users to “Check that ruleset 8.85 has reached your servers. On Imunify360 hosts with the WAF enabled, it arrives without any action,” and provides a version check command for cPanel with Apache.
Are you affected?
Every PHP installation that serves web requests is at risk, according to PHP’s security advisory. The advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as exposed, and states that the risk is highest for mod_php, where an unauthenticated request can trigger the attack before application code runs.
Sansec’s writeup says researchers confirmed unauthenticated remote code execution against Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS.
How to check: log into the site’s hosting control panel and look for a PHP version selector, or ask the hosting provider directly.
What to do now
- Find out which PHP version the site is running today, using the hosting panel or the host’s support team.
- Ask the hosting provider whether the site can be moved to a fixed PHP release for its branch.
- If the site is on shared hosting where PHP is fully managed, ask the host to confirm in writing which PHP version the site runs and when the fix is applied. If the host runs Imunify360, it is reasonable to ask about the WAF and the installed ruleset.
- While waiting for the update, ask the host about temporary measures. Sansec reports that every known trigger is a multipart/form-data request, the format browsers use for file uploads, which PHP parses before the site’s own code runs.
- If you find signs of compromise, the FBI’s Brett Leatherman advised to “isolate the system, preserve your web server and PHP logs, and report it to your local FBI field office,” according to WIRED.
What we’re seeing
Why this is a local business problem, not just a developer problem
Wiz Research wrote that the findings rank among the most severe vulnerabilities discovered in PHP, and that frontier AI models substantially reduced the barrier to proving the old flaws could be exploited.
The customer side of the risk may include data theft. According to Wiz, the flaws can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, and that memory “may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.”
What to ask the hosting provider in writing
- Which PHP version is the site on today, and when will it be on a fixed release for its branch?
- Was the host’s fleet patched against CVE-2026-109618 and CVE-2026-109619?
- Does the server use Apache with mod_php, which PHP says carries the highest risk, or PHP-FPM?
- Does any other service on the plan bundle its own copy of PHP that needs a separate update?
- If the host runs Imunify360, is the WAF enabled and is the current ruleset installed?
- What is the rollback plan if the PHP update breaks a plugin or theme?
FAQ
Related coverage
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check.