What Are the New Critical PHP Vulnerabilities? Patch Guide
PHP fixed two critical flaws on October 21 that let attackers run code under Apache mod_php. Here is what to patch, mitigate or isolate now.
What are the new critical PHP vulnerabilities?
On October 21, PHP released fixes for two critical vulnerabilities. Under Apache's mod_php setup, an attacker can get code to run before the website's own application code starts. That lets them take over the site's platform from underneath the app. PHP powers a huge share of the web, including WordPress sites, so the exposure is broad. UK and European security agencies have advised isolating or taking down affected systems that cannot be patched or mitigated quickly.
TL;DR
- PHP shipped fixes for two critical flaws on October 21, so the first job is to update PHP through your OS, hosting provider or container image.
- The attack path runs through Apache with mod_php, where code can execute before your application even loads.
- UK and European agencies say organizations should isolate or take offline affected systems they cannot update or mitigate quickly.
- Mozilla, Cloudflare and Vercel pushed protections at their layers, but those shields do not replace patching your own servers.
- PHP maintainers reportedly saw signs of a related problem in 2024, which shows how slow, trade-off-heavy maintenance leaves windows open.
- Check the official PHP advisory for exact fixed versions, since the commentary behind this story does not list them.
How does the mod_php attack path work?
Apache can run PHP in two broad ways. With mod_php, the PHP interpreter loads inside the Apache process itself. Other setups hand requests to a separate PHP process. The reported attack targets the mod_php arrangement.
The key detail is timing. An attacker can get code to run in front of the site's own application code, before that application starts. Most web defenses live inside the app: input validation, authentication checks, framework-level protections, WordPress security plugins. If the attacker acts before any of that loads, those layers never get a chance to help. The attacker is effectively hijacking the platform the site stands on.
That is also why the agency advice is so blunt. The problem sits underneath your application, so you cannot fix it by cleaning up your own code.
Who is affected?
Anyone running PHP behind Apache with mod_php should treat themselves as in scope until they have confirmed otherwise. That includes plenty of shared hosting, older VPS builds and long-lived WordPress installs. Sites built on other PHP frameworks are in the same position, because the issue is in the platform, not the app.
Setups that do not use mod_php may have a different risk profile. Do not assume that means safe. Read the official advisory for the exact conditions, and confirm with your host.
What should site owners do right now?
Work through this in order.
- Find out what you run. Check your PHP version and how PHP is attached to Apache.
- Patch. Apply the October 21 PHP fixes through your package manager, host control panel or base image.
- Mitigate if you cannot patch yet. Ask your host about interim protections, and consider putting the site behind a service that filters traffic.
- Isolate if you can do neither. Take the system off the public internet or shut it down until it is fixed.
- Rotate secrets if you suspect compromise. Assume anything stored on an affected server could have been read.
Quick checks on a Debian or Ubuntu style server:
php -v
apache2ctl -M | grep -i php
On RHEL style systems, use httpd -M instead of apache2ctl -M. If the second command lists a PHP module, you are using mod_php. Managed hosting customers should ask the provider directly rather than guess.
Should you isolate or take down a system you cannot patch?
If you cannot update and cannot apply mitigations quickly, the government advice says yes, consider it. That is an unusual instruction. Agencies are telling businesses to interrupt operations because something beneath the application is unsafe.
The cost-benefit is simple. A brochure site that is down for a day loses little. A compromised server can leak customer data, serve malware or become a launch point into the rest of your network. Legacy systems with no maintainer, abandoned plugins or a host that will not update are the likeliest candidates for isolation.
Isolation can be partial. You can restrict access by IP, put the site behind authentication at the network edge, or move it to a segment with no route to sensitive systems. Pick the least disruptive option that actually cuts off the exposure.
What protections did Mozilla, Cloudflare and Vercel roll out?
Several large platforms acted at their own layers.
| Provider | Reported action |
|---|---|
| Mozilla | Distributed protection to standard Firefox configurations within a couple of hours of receiving the report |
| Cloudflare | Moved quickly to protect websites that sit behind its network |
| Vercel | Also got involved with protections for the sites it serves |
These companies act as fronts or serving layers for large numbers of websites. That position lets them put up shields that protect sites even when the individual owners have not updated PHP. It is a real benefit, and it buys time.
It is not a fix. A filtering rule blocks known attack patterns at the edge. Your server still runs the vulnerable code, and anyone who can reach it by another route is not covered. Treat edge protection as a stopgap while you patch.
Why did this take so long to fix?
According to the commentary on this story, PHP's maintainers recognized signs of one of the underlying problems back in 2024. The fixes were hard. They carried compatibility risks, needed scarce expert time and forced a choice between uncomfortable trade-offs. The work reportedly stalled, restarted and was never finished.
That is a familiar open source pattern. Breaking changes upset users, and volunteer time is thin. The difference now is speed on the other side. AI agents can read unfamiliar code, spot something suspicious, write a test, run it, and try again when the first theory is wrong. The same loop works for attackers and defenders. Maintainers no longer get years to debate trade-offs on old weaknesses, because anyone with an agent can go looking.
The scale is already visible. Anthropic has reported more than 29,000 candidate vulnerabilities from six months of scanning important software projects, with about 6,000 manually reviewed and triaged so far. Plenty of unpatched weaknesses are sitting in code people trust.
Is this only a PHP problem?
No. The same week brought other incidents that point to the same pressure. A popular tool for connecting apps to AI models, LiteLLM, disclosed a release that contained credential-stealing malware. Its guidance was to treat the environment as compromised, follow containment instructions and rotate secrets. One detail matters for PHP owners too: the official source tag was reportedly clean while the distributed release held malicious files. Reading the source repository does not prove what is inside the package you installed.
Apply that lesson to your patching. Verify what is actually running on the server, not what the repository says should be there.
Frequently Asked Questions
Do I need to patch if I use WordPress?
WordPress runs on PHP, so the PHP version on your server matters. You usually update PHP at the server or host level, not inside WordPress. Check your PHP version, apply the October 21 fixes, and ask your host if you are unsure.
Does Cloudflare protection mean I can skip the update?
No. Edge protection blocks known attack patterns for sites behind that network, which reduces risk while you work. The vulnerable PHP still runs on your server. Patch it, and treat the shield as a temporary layer.
What if my host will not update PHP?
Ask for a timeline in writing, and ask what mitigations they have in place. If they cannot give you either, plan to move the site or isolate it. The agency advice covers exactly this case.
Where do I find the exact fixed PHP versions?
Use PHP's official release announcements and security advisories, and your OS vendor's package notes. The commentary this article draws on does not list version numbers, so confirm them at the source before you act.
How we source, write, and correct our articles. Editorial standards
