The most important points in 60 seconds / tl;dr
- CVE-2026-109618 and CVE-2026-109619 affect PHP itself. Both are rated critical at 9.2 out of 10 and can allow code execution without authentication.
- PHP-FPM, Apache with mod_php and other PHP web integrations need checking. An application login page is not dependable protection.
- The first fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution packages may instead contain a documented security backport.
- Contact your host or administrator, update PHP, replace old workers and test the application. Updating only WordPress, plugins or Composer dependencies is insufficient.
01
What is affected, and how serious is it?
PHP processes requests on the server for many websites and web applications. Include CMS installations, shops, customer portals, APIs and internal PHP tools in your inventory. The product name alone cannot establish whether the underlying runtime has been fixed.
A CVE is the unique identifier of a known vulnerability. With CVE-2026-109618, PHP may operate on partially initialized data after memory exhaustion. With CVE-2026-109619, invalid memory references from one request can be reused in a later request. A possible outcome is RCE: an attacker runs their own code with the PHP web worker’s privileges.
Exploitation before application code runs has been demonstrated for Apache with mod_php. The second advisory also describes a validated PHP-FPM attack path requiring a suitable application operation. FPM is therefore not a blanket exemption. PHP also lists php-cgi, FrankenPHP and LiteSpeed among environments that need attention.
Authentication inside the PHP application may happen too late. An access restriction enforced upstream or at the network can limit reachability. Internally accessible systems still need the update.
02
Which PHP version do I need?
The table lists the first official PHP releases containing both fixes in each branch. Install these or a later fixed version within the same supported branch.
| Branch | First fix | Earlier affected releases |
|---|---|---|
| PHP 8.2 | 8.2.35 | 8.2.0 through 8.2.34 |
| PHP 8.3 | 8.3.36 | 8.3.0 through 8.3.35 |
| PHP 8.4 | 8.4.27 | 8.4.0 through 8.4.26 |
| PHP 8.5 | 8.5.12 | 8.5.0 through 8.5.11 |
Linux distributions or LTS vendors may retain an older PHP base version while applying security fixes. This is called a backport. Obtain the corrected package version or vendor notice covering both CVEs.
PHP 8.1 and earlier no longer receive regular PHP project updates. Minimal source backports were exceptionally provided for 7.4, 8.0 and 8.1; this does not restart support. Arrange a vendor package or migration to a supported branch. PHP 8.2 reaches end of support on 31 December 2026.
03
What to do now
My practical sequence for operators and administrators:
Identify ownership and inventory
List every domain, subdomain, test system and container. Who updates PHP: the host, an agency or your team? Establish which runtime each application uses.
Confirm and install the patch
Check your current backup and recovery route, then promptly deploy the corrected PHP package or container image. Prioritize publicly accessible systems.
Renew running processes
Restart or replace PHP-FPM, Apache or the relevant runtime following vendor instructions. Every instance and worker must use the corrected code. Downloading an image alone does not update a running container.
Verify the fix and functionality
Confirm patch status in the actual web environment. Then test login, forms, uploads, checkout and background jobs. Record results, package version and time.
Investigate anomalies
Check unexpected files, new accounts, process crashes and unusual requests. If a breach is suspected, isolate the system, preserve logs and evidence, and obtain specialist assistance. An update does not undo an existing compromise.
Send this to your hosting provider
Please confirm that every PHP web instance serving my domains is patched against CVE-2026-109618 and CVE-2026-109619. Which corrected PHP or package version is actually running, when were workers restarted, and do I need to take any further action?
Technical note: the console is only part of the check
php -v shows the command-line version. A website may use another PHP-FPM version or container. Also check the hosting panel or server configuration and package evidence. Do not leave a publicly accessible phpinfo() file as a permanent test.
04
If an immediate update is not possible
CERT-EU recommends considering isolation of publicly accessible applications in this situation. In practice, restrict access at the upstream proxy or network, or temporarily serve a static maintenance page without forwarding requests to PHP.
PHP documents additional interim measures, but no complete configuration fix. These include disabling session.upload_progress.enabled and, on PHP 8.5, fatal_error_backtraces before request processing, followed by restarting every worker. These changes block only particular attack paths.
Take particular care with memory_limit=-1: it removes PHP’s internal memory limit and can jeopardize availability. The interim approach described in the advisory requires additional resource and request limits and still does not replace a patch. Have administrators follow the complete vendor instructions when making changes.
05
Short answers
Is updating my CMS or shop enough?
Only if it demonstrably fixes the affected PHP runtime as well. PHP generally needs a separate update from the host, operating system or container.
Am I automatically safe behind a firewall?
A network restriction can reduce external exposure. A firewall that still forwards web requests to PHP is not evidence of a patch.
Do clean logs prove nothing happened?
No. The PHP advisory explicitly warns against inferring safety from missing error messages. Logs supplement verification but replace neither an update nor investigation of a specific suspicion.
06
Official sources
Checked on 21 October 2026 after patch release. The PHP advisories provide technical details. CERT-EU is cited for the recommendation to isolate temporarily; its advance warning predates the releases.
Sources: PHP: Security advisory, 21 October 2026 · PHP: CVE-2026-109618 / GHSA-w8hw-w9fx-j79w · PHP: CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp · PHP 8.5.12 · PHP 8.4.27 · PHP 8.3.36 · PHP 8.2.35 · PHP: Supported versions · CERT-EU: Security Advisory 2026-018 (Vorabwarnung / advance warning)