Two PHP flaws let attackers run code on web servers.

What's happening.

When PHP runs out of memory it abandons the request in a way some code does not clean up after. Leftover memory can then be read or acted on later in the request. Attackers can trigger that on purpose and use it to run their own code. A second flaw leaves stale request data behind in a similar way. Neither needs a login.

The PHP team fixed both on 21 October 2026. The PHP team treats Apache with mod_php as the highest-risk setup. Branches that no longer get updates, PHP 8.1 and older, stay vulnerable unless you take extra steps.

What it means for you.

A successful attack lets someone run commands on the server behind your website. That can mean a defaced site, stolen customer data, hidden malware or a foothold for attacking the rest of your network.

Any site built on PHP is in scope, including WordPress, WooCommerce, Magento and most small business website builders hosted on your own server or a basic hosting plan.

How to fix it.

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever matches your branch.
2. Ask your web host which PHP version your site runs and to confirm in writing that it is patched. On shared hosting, switch the PHP version in the control panel if it offers a newer one.
3. If you run PHP 8.1 or older, move to a supported version. The PHP team has published minimal backports for 7.4, 8.0 and 8.1 for people who build from source, and some Linux distributions backport the fix. Check yours.
4. The temporary measures in the CERT-EU advisory reduce exposure but do not make a server safe. Only the update does.
5. If a server was unpatched and reachable from the internet, look for unexpected files and accounts, and get help if you find any.