Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What to Do Now (2026)

On 21 October 2026, the PHP project released security updates for two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to run code on a server running PHP. Both are rated 9.2 (critical) on CVSS v4.0.

If your business runs a WordPress site, a WooCommerce store, a Laravel application or any custom PHP system, this one deserves your attention today. The good news is that fixed versions are already available, and the path to safety is clear. This guide explains what happened, who is affected, and exactly what to do, in plain language.

What happened

The PHP project published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two related issues in parts of PHP that nearly every request touches: memory management and error handling.

• CVE-2026-109618, RCE via out-of-memory corruption. If a request hits PHP's memory limit at exactly the wrong moment, PHP can leave internal request data only partially initialized and later treat it as valid, corrupting memory. According to the PHP Foundation, on Apache with mod_php an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

• CVE-2026-109619, RCE via stale global state. A fatal error at the wrong point can leave internal state pointing to memory that has already been freed. A later request handled by the same worker can then use that stale memory. The reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

AWS describes the impact as the ability to execute arbitrary code, read data the PHP process can access, or cause a denial of service on the affected worker.

On exploitation status: the PHP Foundation reports that the CVE IDs leaked a day early and that a researcher's proof-of-concept video was briefly published and copied, which sped up public proof-of-concept work. The PHP security team said it had not identified any functional public exploits at the time of release. That can change quickly, so treat this as urgent.

Who is affected

The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php. The UK NCSC advises organisations not to limit their checks to outdated versions and to identify every PHP installation.

Version ranges as listed in the AWS security bulletin.

For end-of-life versions, the PHP security team provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source, and some Linux distributions and LTS vendors offer backported fixes. Otherwise, upgrading to a supported branch is the answer. Note also that PHP 8.2 reaches end of life on 31 December 2026.

One helpful detail from the Swiss NCSC: Linux distributions often backport security fixes into existing package versions, so an "older looking" version number does not automatically mean you are unpatched. Your vendor's package version and security notice are what count.

What to do now: a step-by-step checklist

1. Find every PHP installation. Start with internet-facing systems. Include production and staging servers, WordPress and WooCommerce hosting, shared hosting accounts, Docker containers and Kubernetes workloads, admin panels and internal tools. PHP often runs in places teams forget about.

2. Update PHP. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's patched package. If you use a managed host, ask them to confirm in writing that the fix is applied. The PHP project notes that the volunteer-run rpms.remirepo.net repository would not have updates on release day, and recommends distribution packages or building from source instead.

3. Restart PHP. An updated package does nothing until the running processes are replaced. Restart PHP-FPM (for example sudo systemctl restart php8.3-fpm), Apache if you use mod_php, and any long-running PHP workers such as queue workers, Laravel Octane or FrankenPHP.

4. Rebuild and redeploy containers. Pull the patched base image, rebuild your Docker images without cache, and redeploy. Running containers do not update themselves.

5. Verify the fix where it matters. php -v on the command line is a good first check, but the CLI and the web server can use different PHP builds. Confirm the version the web server actually uses with a temporary phpinfo() page (delete it right after) or your hosting control panel.

6. Check vendors and appliances. Many products bundle PHP: control panels, monitoring tools, network appliances and third-party SaaS. Ask suppliers whether they are affected and when patches land. NCSC-NL has published an inventory of products with a PHP dependency.

7. If you cannot update yet, apply temporary mitigations. The PHP security advisory lists configuration changes that reduce specific attack paths, such as setting session.upload_progress.enabled=0 in php.ini or the FPM pool (then restarting every worker), lowering post_max_size, and enforcing request size limits at the web server or proxy. These reduce exposure but do not make a system safe. If you cannot mitigate quickly, the UK NCSC advises considering taking the system offline until it is fixed.

8. Look for signs of compromise. Updating does not undo an intrusion that already happened. Review logs for unusual requests and PHP worker crashes, and look for modified files, unexpected processes and unfamiliar admin users or backdoors. If you are unsure, bring in an incident response provider.

Notes for WordPress, Laravel and shared-hosting owners

WordPress and WooCommerce. This is a PHP runtime issue, not a WordPress plugin bug, so updating WordPress or plugins does not fix it. The PHP version on your server is what matters. Check Tools → Site Health → Info → Server in your dashboard for the PHP version, and confirm with your host that the patch is applied.

Laravel. Your application code is not the vulnerable part, but the server running it is. Update PHP on every server and image, then restart PHP-FPM, queue workers (php artisan queue:restart), Horizon and Octane so no old processes keep running. If you deploy with Forge, Vapor, Docker or a CI pipeline, make sure the base image or server PHP is updated, not just the app.

Shared hosting. You usually cannot patch PHP yourself. Contact your host, ask which PHP versions are patched, and switch your site to a fixed version in the control panel if one is offered. If your site still runs on PHP 8.1 or older, now is the right time to plan an upgrade.

AWS users. AWS has published service-specific guidance, including updated Elastic Beanstalk platform versions and Amazon Linux packages. Lightsail instances cannot be updated in place and need new instances from updated blueprints.

How Ryven can help

At Ryven, we build and maintain business software with Laravel, so PHP security is close to home for us. If you would like a second pair of eyes, our team can help you take stock of where PHP runs in your stack, plan and test an upgrade to a supported version, and modernise older applications that are stuck on end-of-life PHP. Book a short call and we will give you an honest view of what needs attention first.

Sources

• PHP.net security advisory and release notes (21 Oct 2026): https://www.php.net/archive/2026.php

• The PHP Foundation, "Today's PHP Security Release, and How We're Strengthening PHP Security": https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

• UK NCSC, "Critical security issue affecting PHP": https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

• Swiss NCSC (BACS), "Critical vulnerabilities in PHP: Install security updates immediately": https://www.bacs.admin.ch/en/warnung-php-en

• AWS Security Bulletin 2026-143-AWS: https://aws.amazon.com/security/security-bulletins/2026-143-aws/

• GitHub advisories: GHSA-w8hw-w9fx-j79w (CVE-2026-109618), GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)