PHP Critical Security Update for Pakistan Websites: Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a web server. Pakistan's National CERT told organisations the same day to prepare to patch. PHP 8.1 and older get no update from the PHP project.

PHP runs a very large share of websites, including most WordPress shops, school portals and small business sites in Pakistan. If your site is on shared hosting, your host controls the PHP version, so the first job is to ask them. We read the PHP project's own announcement and the National CERT advisory on 22 October 2026.

PHP released four security updates on 21 October 2026

The PHP team had warned on 20 October that a critical release was coming on Wednesday 21 October at 14:00 UTC, which is 19:00 in Pakistan. It then shipped fixes for the four supported branches: 8.5, 8.4, 8.3 and 8.2. Both flaws score 9.2 out of 10 on the CVSS v4.0 scale.

The two flaws let a remote request run code before your application starts

PHP says the first flaw, CVE-2026-109618, comes from out-of-memory handling that leaves request data half set up. The second, CVE-2026-109619, leaves old request state alive for the next request on the same worker. Both can lead to remote code execution without a login.

The PHP team says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where it has shown an exploit that fires before any application code runs. That means a plugin update will not protect you.

Updating WordPress does not update PHP

The National CERT advisory makes one point very clearly: updating WordPress, Joomla, Drupal, Magento or their plugins does not replace the PHP runtime underneath. PHP is a separate server-level update, done by your host or your system administrator.

For a site on shared hosting, ask your provider in writing which PHP build is running and whether it contains the October 2026 fix. If you use a control panel with a PHP version selector, choosing 8.5, 8.4, 8.3 or 8.2 only helps once the host has installed the patched build.

PHP 8.1 and older need a vendor backport or an upgrade

The PHP project no longer updates 8.1 and older. It built minimal source backports for 7.4, 8.0 and 8.1 for people who compile PHP themselves. Everyone else should ask their Linux distribution or hosting vendor for a backported fix, or move to a supported version.

This matters in Pakistan because many small sites sit on old PHP versions for years, since a newer version can break an old theme. Moving up may need a developer to test the site first. Leaving an old version online is the riskier choice now that a public warning exists.

If you cannot update today, these settings reduce risk but do not fix it

PHP lists stopgaps: set a low post_max_size, turn off session upload progress, and on PHP 8.5 turn off fatal error backtraces. It says clearly that only an update is a full solution, and that these steps do not make an installation safe.

1. Ask your host for the exact PHP version and build now.
2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as soon as your host has it.
3. Until then, ask the host to set session.upload_progress.enabled to 0 and restart every worker.
4. Set post_max_size to 8M if your site takes no uploads, or 32M if it does.
5. Look for new or changed .php files in your uploads folder.

The National CERT advisory and PHP's page differ on patch status

National CERT's advisory NCA-19.211026, dated 21 October, says patches were still pending and lists the fixed versions as "reportedly expected". The PHP project's page shows the four releases as published on 21 October. Trust the PHP page for availability.

The advisory also says exploit demonstrations, reported under the name "PHP2Shell", and early attack activity have been seen. We could not confirm attacks ourselves. If you find a compromise, report it to National CERT.

Common questions about the PHP security update

Which PHP versions fix the critical flaws?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026.

Is my WordPress site affected?

If it runs on PHP and serves web requests, the PHP project says yes, whatever the CMS. The fix is a PHP update by your host, not a WordPress update.

What if my host runs PHP 8.1 or older?

The PHP project ships no update for those. Ask the host for a backported fix or an upgrade to 8.2 or newer.

Can I fix this myself on shared hosting?

Not fully. You can choose a PHP version in your control panel, but the patched build must be installed by the host.

Where do I report a hacked site in Pakistan?

Report incidents to National CERT at cert@pkcert.gov.pk or the portal at pkcert.gov.pk, as the advisory lists.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked 22 October 2026. We read the PHP project's front page and security notice of 21 October 2026, including the fixed versions, risk description and interim settings. We also read National CERT's advisory NCA-19.211026 as a PDF. We did not run the exploit or test any server, and we could not confirm attacks in Pakistan. Your host's own notice is the final word on your site.