Critical PHP Security Vulnerabilities: What You Need to Know

Updated: 22 October 2026

Two critical security vulnerabilities have recently been identified in PHP, the programming language that powers WordPress and many other websites and web applications.

Following the release of security patches, we have been working with our hosting partners to ensure affected PHP versions are updated as quickly as possible.

What is the issue?

PHP has disclosed two critical vulnerabilities that could potentially allow an attacker to execute malicious code on an affected server.

In simple terms, these vulnerabilities relate to how PHP handles data and memory. Under certain circumstances, an attacker could exploit these weaknesses to run their own code on a server, potentially compromising the websites or applications hosted on it.

The two vulnerabilities are:

1. Remote Code Execution via Out-of-Memory Corruption

PHP can mishandle data when it runs out of available memory. Under certain circumstances, this could allow an attacker to exploit the PHP process and potentially execute malicious code on the server.

2. Remote Code Execution via Stale Global State

PHP can accidentally retain and reuse data from a previous request. Under certain circumstances, an attacker could potentially exploit this behaviour to execute malicious code.

Both vulnerabilities are considered critical due to the potential impact of a successful attack.

Which PHP versions are affected?

The PHP project has released patched versions to address these vulnerabilities:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older versions no longer receive security updates from the PHP project. However, some hosting providers may provide their own security fixes for older versions.

What are ADAO doing?

The action required depends on where your website is hosted and who manages your server.

Customers hosted on WP Engine

We have been working closely with WP Engine throughout the security release to ensure affected PHP versions are updated.

WP Engine introduced additional protective measures at the CDN layer while the patches were being released and subsequently began rolling out the security updates across its platforms.

We can confirm that the affected PHP versions running on the WP Engine servers hosting our customers’ websites have now been patched.

No further action is required from you to secure your website against these vulnerabilities.

Customers hosted on our Mid Servers

For websites hosted on our Mid Server infrastructure, we have worked with our hosting partners, UK Servers, to apply the necessary security updates.

The affected PHP versions running on our servers have now been patched.

No further action is required from you to secure your website against these vulnerabilities.

Customers using other managed hosting providers

If your website is hosted with another managed hosting provider, we recommend checking their latest security announcements to confirm that the appropriate PHP patches have been applied.

Managed hosting providers are generally responsible for maintaining the server environment, including applying relevant security updates. However, this can vary depending on your hosting agreement.

If you’re unsure whether your hosting provider has addressed the issue, please contact us and we can help you establish what action may be required.

Customers managing their own servers

If you or your organisation manage your own dedicated server, you will need to ensure that PHP has been updated to a patched version.

Where supported, we recommend using one of the following versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If your server is running PHP 8.1 or older, you should review your available security updates and consider upgrading to a currently supported PHP version.

You can find the latest security information directly from the PHP project at https://www.php.net/.

What should you do?

If your website is hosted on our Mid Servers or through WP Engine, no further action is required to address these specific PHP vulnerabilities.

However, PHP is used by many services beyond your main website. We recommend reviewing any other third-party platforms or systems your business relies on, particularly those that process or store sensitive information.

These may include:

• Booking engines
• Gift voucher platforms
• Payment and ecommerce systems
• Customer relationship management (CRM) platforms
• Guest management systems
• Internal business applications
• Other websites or web applications hosted on separate servers

If any of these services use PHP, their respective providers should confirm that the appropriate security updates have been applied.

Keeping PHP up to date

PHP versions eventually reach the end of their supported lifecycle and stop receiving security updates from the PHP project.

Although some hosting providers may continue to support older versions by applying their own security fixes, we recommend keeping websites on a currently supported PHP version wherever possible.

This helps ensure that future vulnerabilities can be addressed promptly and reduces the risks associated with running outdated software.

Summary

Two critical vulnerabilities have been identified in PHP that could potentially allow attackers to execute malicious code on affected servers.

Security patches are now available, and the affected PHP versions on our own hosting infrastructure and WP Engine platforms have been updated.

If your website is hosted on our Mid Servers or through WP Engine, no further action is required from you to address these vulnerabilities.

If you use another managed hosting provider, we recommend confirming that the relevant updates have been applied. If you manage your own server, please ensure that you have installed the appropriate security patches.

If you’re unsure whether your website or hosting environment is affected, please get in touch with our team and we’ll be happy to help.