On 21 October 2026, the PHP team disclosed two critical flaws that may let an unauthenticated attacker run code on a web server before application code starts. The risk covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed installations serving web requests.
Which releases contain the fixes?
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
What should you do today?
- Check the PHP version in your hosting panel or on the server.
- Upgrade to a fixed release, then restart PHP and the web server.
- Review logs for unusual requests before the upgrade, especially on mod_php.
- Test sign-in, orders and payments after the change, with a current backup available.
Is Evan Code's website affected?
Evan Code runs on Next.js and does not execute PHP, so these specific flaws do not apply to its stack. We are publishing the alert because many WordPress and PHP sites in the region remain exposed until the server runtime itself is patched.