Critical PHP vulnerabilities have raised security concerns for website owners, developers, and hosting providers because successful exploitation could allow attackers to execute malicious code on vulnerable servers. PHP has released security updates addressing critical remote code execution flaws, while cybersecurity agencies have urged administrators to identify affected installations and apply the appropriate patches immediately.
What Are These Critical PHP Vulnerabilities?
One of the significant flaws is tracked as CVE-2026-6722. It is a use-after-free vulnerability in PHP’s SOAP extension that can potentially allow remote code execution. The issue occurs when the extension mishandles object references during SOAP request processing, potentially allowing an attacker to exploit freed memory. The vulnerability carries a CVSS 3.1 score of 9.8 in the National Vulnerability Database, indicating critical severity. An attacker can potentially exploit the flaw without authentication by sending a specially crafted SOAP request to a vulnerable installation. Because the attack does not require a login, exposed servers using the affected functionality may face significant risks. However, actual exposure depends on the PHP version, server configuration, and enabled components.
Affected PHP Versions and Fixes
CVE-2026-6722 affects PHP versions earlier than the following patched releases:
- PHP 8.2.31
- PHP 8.3.31
- PHP 8.4.21
- PHP 8.5.6
These versions address the original SOAP vulnerability. Administrators should install the latest available security release for their supported PHP branch rather than stopping at these earlier fixes.
PHP subsequently released additional security updates on October 21, 2026, addressing two more critical remote code execution vulnerabilities. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The latest updates are particularly important for internet-facing servers running PHP through Apache’s mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed. PHP has identified mod_php as a particularly high-risk configuration for the newer vulnerabilities.
Other Flaws Disclosed With the Critical PHP Vulnerabilities
The broader PHP security updates address several other vulnerabilities affecting different components. These include issues involving database drivers, request validation, character-handling functions, and memory management.
Examples include CVE-2025-14179, associated with SQL injection risks in the PDO Firebird driver, and CVE-2026-6735, involving cross-site scripting in the PHP-FPM status page. Other reported issues include denial-of-service risks associated with ctype functions and the mbstring extension, along with additional memory-management flaws.
These vulnerabilities have different causes and impacts. Administrators should review the applicable security advisories and distribution-specific package updates rather than assuming that every issue carries the same exploitation risk.
Vendor Response and Security Status
The original SOAP vulnerability was disclosed in May 2026, followed by security notices and fixes from Linux distributions and other vendors. In October, PHP announced another security release addressing two critical vulnerabilities, prompting renewed warnings for organizations operating internet-facing systems.
The October vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are also associated with potential unauthenticated remote code execution. A proof of concept has been reported, increasing the urgency of applying the available patches. However, the availability of proof-of-concept code does not by itself establish widespread exploitation in the wild.
How to Protect Your Servers From Critical PHP Vulnerabilities
Administrators should take the following steps to reduce their exposure:
- Update PHP immediately. Install the latest supported security release for the relevant PHP branch.
- Apply operating system updates. Linux distributions may provide patched packages with version numbers that differ from upstream PHP releases.
- Review enabled extensions. Disable the SOAP extension if it is unnecessary, while recognizing that this does not protect against unrelated PHP vulnerabilities.
- Secure PHP-FPM status pages. Restrict access to trusted systems and authorized administrators.
- Monitor server activity. Review web server, application, and system logs for suspicious requests, unexpected processes, or unusual outbound connections.
- Check hosting environments. Shared hosting customers and managed WordPress users should confirm that their providers have applied the appropriate security updates.
If immediate patching is not possible, organizations should consider isolating vulnerable internet-facing services until remediation is complete.
