Security alert: critical vulnerabilities in PHP

Oct 21, 2026

Two critical vulnerabilities have been found in PHP, a technology widely used for websites and web applications. An attacker could exploit an affected server simply by sending it a specially crafted web request, without needing to log in.

The PHP project released fixes on October 21, 2026. SAP and Microsoft core platforms are not known to be affected, but PHP-based applications running in or around those environments may be.

If your organization uses PHP, identify where it is running and check whether an update is required.

Severity

Critical

Fix available

Yes, since October 21, 2026

Who may be exposed

Organizations running affected PHP versions, particularly on internet-facing websites and applications

Reference

CVE-2026-109618 and CVE-2026-109619

This page was last updated on October 22, 2026.

What happened

PHP is a widely used technology behind websites, web shops, customer portals, and many business tools. On October 20, 2026, the PHP project warned of two critical security vulnerabilities, and details became public before fixes were ready. Fixes were released on October 21.

The vulnerabilities are in PHP itself, not in one particular application. This means a website can be exposed even if its own code is well written. An attacker who can reach an affected web server could potentially take control of it, access data stored there, or use it as a stepping stone into other systems.

Security researchers and national cybersecurity centers report that attack code is already circulating publicly and that attackers have begun scanning for vulnerable servers. Widespread attacks are expected. Applying the appropriate security update is the only complete fix.

Why this matters now

Attackers move quickly once details of a vulnerability become public. Internet-facing systems running an affected version of PHP should therefore be treated as the first priority.

Why we are sharing this

PHP is not a core technology offering at delaware, but it is used in some client environments, including websites and applications connected to or running alongside SAP, Microsoft and Salesforce solutions. We are sharing this alert to help you identify potential exposure and take action where needed.

Are SAP, Microsoft, and Salesforce affected?

We checked public vendor and national cybersecurity sources on October 21 and 22, 2026. At the time of writing, we found no SAP, Microsoft or Salesforce security advisory identifying their core platforms as affected by these vulnerabilities.

The practical risk lies in PHP-based websites, applications, and servers connected to or running alongside those platforms.

The key distinction: Using a vendor-managed SAP, Microsoft or Salesforce cloud service is different from running your own PHP application on SAP, Microsoft or Salesforce cloud infrastructure. The latter still needs to be checked.

SAP

Core platforms not known to be affected

SAP’s core business systems, such as S/4HANA and other ABAP- or Java-based platforms, are not known to be affected by these vulnerabilities. No SAP security note or statement about these vulnerabilities was found at the time of writing.

We advise you to check if you are using PHP here:

Websites, portals, and shop front ends that connect to SAP but run on PHP.

PHP applications that you have deployed yourself on cloud platforms, including SAP’s own cloud platform, where updating the PHP runtime is your responsibility.
Servers underneath or alongside your SAP landscape where PHP is installed as part of the operating system or a supporting tool.

Microsoft

Core platforms not known to be affected

Microsoft 365, Dynamics 365, and Entra ID are not known to be affected by these vulnerabilities. No Microsoft security advisory about these vulnerabilities was found at the time of writing.

We advise you to check if you are using PHP here:

PHP websites and applications running on Azure virtual machines, containers, or Kubernetes.
Azure App Service sites that use a PHP runtime, where the selected PHP version may need to be updated.
Windows or Linux web servers, such as IIS, Apache, or Nginx, with PHP installed, whether hosted in Azure or on-premises.

Salesforce

Core platforms not known to be affected

Salesforce is aware of and actively monitoring these PHP vulnerabilities. At the time of writing, Salesforce reports no evidence of exploitation affecting Salesforce or customer data.

We advise you to check if you are using PHP here:

PHP applications running on Heroku.
PHP websites, web-to-lead forms, or portals that sit outside Salesforce and connect to it.
PHP-based middleware that connects to Salesforce.

This assessment reflects publicly available information as of October 21, 2026. SAP and Microsoft may publish further guidance, and a national inventory of affected software products is still being compiled. We will update this notice if the situation changes.

What this means for you

If you only use vendor-managed SAP or Microsoft cloud services

Your core SAP or Microsoft services are not currently known to be affected by these PHP vulnerabilities. You should still check whether your organization operates separate PHP-based websites, portals, or applications.

If you run PHP-based websites or applications

Check which PHP version they use and whether an update is required. This includes applications built on popular platforms and frameworks such as WordPress, Drupal, Magento, Joomla, and Laravel, whether they are hosted internally, in the cloud, or by an agency or hosting provider.

If you use an older PHP version

The PHP project has released fixes for PHP versions 8.2 through 8.5. Older versions are no longer officially supported. If you use an older version, plan an urgent upgrade or ask your software or hosting provider whether they provide a security fix.

If you do not know whether you use PHP

Ask your IT team, web agency, or hosting provider to check. Start with websites and applications that can be reached from the internet. Still unsure? Reach out to us, we can help you.

NOT EVERY NOTIFICATION MEANS YOU ARE AFFECTED

Many organizations will find that none of their important systems run PHP. The purpose of this notice is to help you determine quickly whether you need to take action.

What we are doing

The delaware BeLux National Security Office – Operations Defense team is monitoring the situation closely.

We are checking where PHP is present in the environments we manage or monitor on your behalf. If one of your systems requires attention, we will contact you through your Service Delivery Manager.

As always, we will not make changes to your systems without your approval, and we will confirm with you once any fix has been implemented.

What we recommend you do

1. Find out where you use PHP

Make a short list of websites, portals, and web tools that run on PHP, starting with those that are accessible from the internet.

If you are unsure, ask your IT team, web agency, and hosting provider.

2. Apply the appropriate security update and restart

Apply the security update provided for your PHP installation.

For PHP itself, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If PHP is provided through an operating system, hosting platform, or software vendor, follow that vendor’s security update guidance.

Remember that the web server or application may need to be restarted afterward for the fix to take effect.

Temporary workarounds can reduce exposure, but they are not a replacement for applying the appropriate security update.

3. Address older versions

If a system runs a PHP version that no longer receives official fixes, plan an urgent upgrade, ask your vendor whether they provide a security fix, or limit access to the system until the issue is resolved.

4. Ask your suppliers

Ask agencies, software vendors, and hosting partners that manage PHP-based applications for you to confirm in writing that they have applied the appropriate updates and checked for signs of misuse.

5. Stay alert for unusual activity

If a website behaves unexpectedly, or you notice unfamiliar files or unusual activity on a PHP web server from October 20 onward, when details of the vulnerabilities became public, contact your Service Delivery Manager immediately.

If something looks suspicious, early reporting can make a real difference.

Frequently asked questions

Is my SAP system at risk?

Your core SAP systems are not known to be affected by these PHP vulnerabilities. The risk lies in PHP-based websites or applications that connect to SAP or run alongside it.

If you are unsure whether any such applications exist in your landscape, ask us and we will help you check.

We only use Microsoft 365. Do we need to do anything?

Not for Microsoft 365 itself. Microsoft manages that service, and it is not currently known to be affected by these PHP vulnerabilities.

You should still check any separate PHP-based websites, applications, or servers that your organization operates.

Is a fix available?

Yes. PHP released updated versions on October 21, 2026. Some operating system, hosting, and software vendors may provide their own security updates, so check their guidance if you do not manage PHP directly.

Can we protect ourselves without updating?

Temporary measures may reduce exposure, but they do not provide the same protection as applying the appropriate security update and may disrupt normal website operation. Updating remains the recommended solution.

Who do I contact with questions?

For questions, contact us info@delaware.co.uk

For questions about services we manage for you, you can also contact your Service Delivery Manager.