Critical PHP Vulnerabilities 2026: How to Patch and Protect Your Site

What Happened

Two critical remote code execution vulnerabilities were found in PHP — CVE-2026-109618 and CVE-2026-109619. They affect memory management and error handling, parts that are involved in virtually every request. The flaws had been hiding in the codebase for over a decade.

The patch was released on October 21. Before it could be installed, organizations worldwide — government agencies, hospitals, universities — temporarily took their sites offline: in the UK, France, the Netherlands, and other countries. In Russia, the National Coordination Center for Computer Incidents (NCCCI) under the FSB recommended that critical infrastructure operators restrict access to their sites if they couldn't update quickly.

Why This Is Massive

PHP is a server-side language that powers about 70% of the world's websites. According to W3Techs, that figure is 69.3% globally and 90.8% among Russian-language sites. PHP powers WordPress, Wikipedia, Slack, a significant portion of Facebook, and — importantly for Russia — 1C-Bitrix.

The vulnerabilities affected all PHP versions from 5.x onward. That means not only "old" sites were at risk, but also projects that hadn't updated their runtime in years.

The Main Trap: Updating the CMS Is Not Enough

Many owners of WordPress or 1C-Bitrix sites assumed that updating the CMS was sufficient. It's not.

The problem is in PHP itself, not in a specific CMS. Updating WordPress, Drupal, Joomla, or another system does not fix the vulnerability in the language. As long as the server runs a vulnerable PHP version, the site remains at risk.

That's why experts recommended updating PHP itself — to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 — and then restarting the web server and background workers so old code doesn't remain in memory.

Another Detail: The Vulnerabilities Were Found with AI

Both vulnerabilities were discovered using AI tools: OpenAI models (GPT-5.6 Sol) and Google (Gemini 4 Argon, Wiz Atlas). Without AI, finding them would have been extremely difficult — they require an "exceptionally complex chain of steps".

But there's a flip side: once the patch was out, AI tools could help attackers adapt exploits to different PHP versions and configurations faster. Amazon detected an exploitation attempt as early as October 17 — four days before public disclosure.

How a React + FastAPI Stack Differs

Now to the main point: why we at Webzella build projects on React + FastAPI, and how that relates to news like this.

1. Less "shared" infrastructure — smaller attack surface.

A PHP site usually means: web server (Apache/Nginx) + PHP-FPM + CMS + plugins. A vulnerability in any part of this chain can affect the entire site. In a React + FastAPI stack, the chain is different: React is static assets on a CDN, FastAPI is a Python backend. There's no PHP interpreter, no CMS with dozens of plugins, no codebase shared by millions of sites where one bug can affect everyone.

2. Updates are controlled, not "delivered by the vendor."

When there's a vulnerability in PHP, a WordPress site owner depends on a chain: PHP Foundation releases a patch → hosting updates PHP → you update the CMS. A delay is possible at every step. In a custom stack, dependency updates (Python packages, Node modules) are part of your CI/CD. You see what gets updated and when, and you can roll back if something goes wrong.

3. A vulnerability in FastAPI or React is not "a vulnerability in 70% of the internet."

FastAPI and React are popular tools, but they are not a single monolithic codebase powering millions of sites with identical configurations. A vulnerability in a specific library affects projects that use it. That's still serious, but the scale is incomparable to "a bug in PHP that affects every request on every PHP site."

4. Architecture matters more than language.

We're not claiming React + FastAPI is "invulnerable." Any code can be hacked. But security is not "choosing a language with no bugs." It's control over what runs on the server, how dependencies are updated, and who is responsible for incident response. In a custom stack, that control is with you and your team. In an off-the-shelf solution, it's with the vendor and the hosting provider.

What to Do If Your Site Runs on PHP

If your site runs on PHP (especially an old version or custom code), here's what to do now:

• Update PHP to the patched version. That's the first and most important step.
• Restart the web server and PHP-FPM so old code doesn't remain in memory.
• Check the server for signs of compromise if it was exposed to the internet before the patch. Change passwords, keys, and tokens.
• If you can't update — temporarily restrict access or use a WAF.

But if you're planning a new project and want security to be part of the architecture rather than a reaction to news — consider a custom stack.

Takeaway

PHP2Shell is not "PHP is bad." It's a reminder that mass technologies create mass risks. 70% of the world's websites run on PHP, and when a vulnerability is found in it, it affects millions of projects at once.

We build on React + FastAPI not because it's trendy, but because we want to control what runs on the server, how dependencies are updated, and who is responsible when something goes wrong. If that matters to you — write to us. We'll review your task and show you how it works in practice.