PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can permit unauthenticated remote code execution.
What happened
The PHP Foundation’s October 21, 2026 advisory says the vulnerabilities affect all PHP installations serving web requests. Both GitHub advisories rate them critical with a CVSS v4 base score of 9.2, while Cloudflare reported seeing early attacks before the official release, according to WIRED.
Update, October 22, 2026
Web administrators whose host uses Imunify360 should check that ruleset 8.85 has reached the server. CloudLinux says Imunify360 with the WAF enabled receives the rulesets automatically, while PHP states that updating is the only complete solution. PHP 8.1 and older receive no release from the PHP project, although its security team published minimal source backports for PHP 7.4, 8.0 and 8.1. CloudLinux also reported fixed ea-php packages for cPanel EasyApache 4, covering ea-php52 through ea-php85.
Are you affected?
PHP says the affected deployments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. An audit should record the PHP version, SAPI, package source and patch date for public servers, private applications, appliances, containers, network devices and management interfaces.
According to PHP, the fixed thresholds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 for their respective branches. PHP 8.1 and older are outside current project support, while distributions and long-term-support vendors may provide backported packages. Some distributions and LTS vendors provide backported fixes, so PHP advises contacting your vendor for details.
What to do now
- Inventory every PHP installation that serves requests. Include internet-facing systems, internal applications, appliances, container images, embedded products and services supplied by third parties. Check the server control panel, hosting documentation or package manager for the PHP version, SAPI and package provider.
- Restart PHP-FPM or the web server after updating so every worker loads the new runtime. Check again because hosting servers may run several PHP versions at once.
- CloudLinux calls this a virtual patch: it stops known request patterns at the server edge while the vulnerable PHP code stays as it is. PHP says updating is the only complete solution.
- For CVE-2026-109618, PHP’s advisory recommends setting memory_limit=-1 preferably where applications cannot override it, setting a low post_max_size, enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count and nesting depth, and using a container or cgroup limit as an availability boundary. According to PHP’s advisory for CVE-2026-109619, set session.upload_progress.enabled=0 in configuration that applies before request parsing and restart every worker. This blocks the confirmed session paths but not other variants. According to PHP, set fatal_error_backtraces=0 on PHP 8.5 and restart every worker. This blocks the confirmed fatal backtrace path only. PHP says these measures reduce exposure to specific attack paths but do not make an installation safe.
What we’re seeing
What do the two PHP vulnerabilities do?
How does CVE-2026-109618 cause remote code execution?
CVE-2026-109618 affects PHP’s handling of an out-of-memory error. PHP uses longjmp() to leave the current request context, and some request memory can be reachable before full initialization. An allocation failure may leave that memory invalid, while shutdown processing treats it as valid data.
Apache mod_php invokes request shutdown even when request startup fails, including during automatic request-body parsing. This can occur before application-specific code executes. PHP’s GitHub advisory says source analysis supports FPM as susceptible, but it reports no complete FPM exploit demonstration for that SAPI.
How does CVE-2026-109619 use stale state?
CVE-2026-109619 involves global state retained by a PHP worker. That state may refer to memory owned by one request. If it is not reset before the memory is released, a later operation or request handled by the same worker may use the stale reference. The demonstrated producer and consumer can occur in separate HTTP requests handled by one worker.
The GitHub advisory says exploitation requires a producer that stores request-owned state and a consumer that acts on it before normal request initialization resets it.
What should a site audit report?
Include the runtime version, SAPI, package provider, patch date and restart status in technical maintenance records.
The NCSC advises that organizations should identify systems running PHP across their infrastructure, including monitoring appliances, network devices and management interfaces that may bundle PHP as a component, and apply updates as they become available, according to the NCSC. According to Sansec, every known trigger in its research is a multipart/form-data request, the format browsers use for file uploads.
If compromise is suspected, Brett Leatherman, the FBI’s cyber assistant director, advised isolating the system, preserving web server and PHP logs and reporting the incident to the local FBI field office, as reported by WIRED. According to PHP and Microsoft, upgrading is the only way to fully remediate these vulnerabilities, and the Azure WAF mitigations are not a replacement for patching.
FAQ
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are described as fixing both vulnerabilities.
Does updating WordPress fix these PHP vulnerabilities?
No.
Does an Imunify360 ruleset replace the PHP update?
No. CloudLinux calls the Imunify360 rulesets a virtual patch and interim mitigation.
Try the site audit tool
SEOScanPro runs a full technical audit of a site and shows the measured result behind every check. Open the site audit tool.