In simple terms, a hacker could use them to break into a website’s server from far away, without needing physical access or a password. Security experts around the world have warned that the flaws could let attackers take control of affected servers. Story so far: On October 21, 2026, the team behind PHP announced two serious security flaws.
How long has this been known?
It took a long time to sort out, and the Foundation has admitted there were delays. Both flaws were made public this month, along with fixes. That doesn’t mean hackers have been using them for two years. Finding a flaw, working out whether it can really be abused, reporting it safely and proving someone actually attacked are all separate steps. It does show how tricky it is to look after a popular, free software project. Finding a bug is just the beginning. Developers also have to judge how risky it is, build a fix that works, make sure the fix doesn’t break anything else and help people install it.
The group that supports PHP, the first flaw was spotted in 2024 during a security review, according to the PHP Foundation.
So what can you do?
And a website that was fine yesterday can need an urgent update today. PHP is a programming language that runs behind the scenes on websites. You never see it, but you use it all the time. Say you log into your bank’s website or book a movie ticket. Your details travel to a server, which checks who you are, looks up your information and sends back the right page. PHP is often the tool doing that work. It’s especially common in the systems that power online shops, blogs, news sites, membership sites and business tools. If something goes wrong with PHP, a lot of websites can be affected at once. That’s true whether it’s a small shop on cheap shared hosting or a big company with hundreds of servers. Think of a computer’s memory as a huge set of shelves. Programs put things on the shelves, take them off and tidy up when they’re done. Good software has to keep careful track of what’s where, especially when something goes wrong halfway through a task. The two flaws are both mistakes in this tidying-up process. The first is a problem with running out of space. When PHP runs low on memory, it can end up handling half-finished data badly while cleaning up. This can leave the shelves in a mess, which is called “memory corruption. The second is a stale note. In some error situations, PHP keeps a note pointing to a shelf that has already been cleared. Later, it tries to use what it thinks is there, but finds something else entirely. This can also corrupt memory. A skilled attacker can sometimes use these messes to sneak in their own instructions and make the server run them. That’s called “remote code execution. If PHP has enough permissions on the server, an attacker could read private data, steal passwords or change what your website shows. There’s another catch. These flaws sit deep inside PHP itself, so they can be triggered before a website’s own protections, such as login checks, get a chance to step in. A website can have strong security of its own and still be exposed. The main step is to update PHP. The fixes are available, and website owners and companies need to check and install them. That’s not always quick. A big organisation may have PHP running in many places: live servers, internal tools, testing systems and more. Fixing one doesn’t fix the rest. If there are signs of a break-in, installing the fix may not be enough. Passwords might need changing, harmful changes removed and affected systems rebuilt from scratch. If your site is on managed hosting, ask your provider which version of PHP they use and whether the security fix has been installed. If you run your own servers, list every place PHP is installed, and don’t assume that updating your main website covers everything. A website isn’t one single thing. It’s many pieces working together, and each piece can have its own weak spots. Encryption keeps your information private while it travels, but it can’t promise that the server at the other end is safe. A strong password can’t fix a flaw in the software underneath. Most of the web runs quietly in the background, and we only notice it when something breaks. When it does, fixing it takes effort from everyone involved.
Because the fix is up to the people who run the websites, if you’re just a visitor, there’s nothing you need to do yourself,.
It’s also worth checking whether anyone got in before the update.
