On 21 October 2026 the PHP project fixed two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. Neither needs a login. The fix is to upgrade PHP version on every server to a patched release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This post covers what the bugs are, who is exposed, how to check what you run, and what to do if you cannot patch today.
Everything here is drawn from primary sources, linked where each fact appears. Where those sources disagree, we say so.
What the two CVEs are
Both bugs were published in the PHP project's release announcement (php.net, 2026), after an advance notice the day before. Each has a GitHub security advisory with the technical detail.
CVE-2026-109618: RCE via out-of-memory corruption. PHP handles out-of-memory errors with longjmp(). If memory runs out during request startup, body parsing or multipart parsing, request state is left half built. Request shutdown can then act on that broken state. The advisory GHSA-w8hw-w9fx-j79w (PHP project, 2026) gives three triggers. One is a multipart request with no declared length that slips past post_max_size. Another is unlimited part headers that use up memory_limit. The third is empty file controls that max_file_uploads does not count. The PHP team confirmed code execution over HTTP against mod_php with default limits. It calls PHP-FPM and FrankenPHP "likely susceptible".
CVE-2026-109619: RCE via stale global state. This is a use-after-free in persistent workers. State owned by one request survives a fatal error, and a later request on the same worker reads it. The advisory GHSA-6wmf-4rv5-p3rp (PHP project, 2026) confirms two paths. One is PHP-FPM through session upload progress, which is on by default. The other is mod_php with fatal_error_backtraces on PHP 8.5. LSAPI is a conditional candidate.
How severe. The PHP project scores both at 9.2 under CVSS 4.0. NVD's own CVSS 3.1 scores differ: 9.8 for CVE-2026-109618 and 8.1 for CVE-2026-109619 (NIST NVD, 2026). Red Hat rates the pair Important. Whichever score you use, this is a PHP security update to apply now, not at the next maintenance window.
Who is affected
According to php.net, the exposed setups are PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk, because the attack can land before any application code runs. No primary source discusses the command-line PHP binary on its own.
That covers most PHP websites: WordPress, Drupal, Laravel, Symfony and custom applications all run on one of those server APIs. The bug sits in PHP itself, so the framework or CMS on top does not matter. What matters is the PHP build that serves web traffic.
On PHP 8.1 or older? The official affected ranges start at 8.2. The PHP Foundation (2026) and php.net do not say when the bugs were introduced. A widely shared DigitalOcean post says every version from PHP 5 onward is affected. We found that claim only in that post. Treat 8.1 and older as unsupported and assume they are vulnerable, rather than treating them as confirmed affected.
PHP 8.1 end of life has a practical meaning here. php.net publishes no official release for 7.4, 8.0 or 8.1. It does link minimal source backport branches on GitHub, such as PHP-8.1-CVE-2026-109618-109619, for teams able to build PHP from source.
Upgrade PHP version: the fixed releases
The patched versions are the same for both CVEs. Anything below them on a supported branch is vulnerable.
PHP 8.6.0 RC4 also carries the fixes. PHP 8.2 security support ends on 31 December 2026, according to the supported versions page (php.net, 2026). If you are moving off 8.2 anyway, this is a reason to go straight to 8.4 or 8.5 rather than patch twice.
Distributions complicate the version number. Ubuntu backports the fix without changing the upstream number, so a patched Ubuntu 24.04 server still reports PHP 8.3.6. Its fixed package is 8.3.6-0ubuntu0.24.04.13, according to Ubuntu's CVE page (Canonical, 2026). Ubuntu 22.04's php8.1 is patched at 8.1.2-1ubuntu2.28. Debian bookworm ships 8.2.35-1~deb12u1 and trixie ships 8.4.27-1~deb13u1, per the Debian security tracker (Debian, 2026).
How to check and upgrade
Start with the version the web server actually runs. The command-line PHP and the PHP-FPM service can be different builds on the same machine.
A phpinfo() page shows the version the web server API reports. Remove that page as soon as you have read it, because it exposes configuration detail.
Ubuntu and Debian. Distro packages and the ondrej PPA both update through apt. The upgrade command DigitalOcean publishes is:
sudo apt update && sudo apt install --only-upgrade 'php*'Then restart the service that runs PHP, for example sudo systemctl restart php8.3-fpm with your own branch number, or apache2 if you run mod_php.
RHEL, AlmaLinux and Rocky with Remi. Remi has shipped all four fixed versions for EL 8 and later, according to the Remi repository blog (2026). Run sudo dnf update 'php*', then sudo systemctl restart php-fpm httpd. Red Hat's CVE page (2026) notes that exploitation on RHEL's default FPM setup is hard. It still ships fixes, so apply them.
Docker. The official PHP images (Docker, 2026) have tags 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Pin your FROM line to the fixed tag, pull, rebuild and redeploy. A floating tag only helps once you rebuild.
Managed hosting and WordPress hosting. If the host controls PHP, the host has to patch it. The DigitalOcean advisory (2026) says App Platform and Functions need a redeploy, and that Cloudways is patched by DigitalOcean. Droplets are affected only if you installed PHP yourself. For other hosts, check the PHP version in the control panel, then ask support to confirm the fixed build is live.
If you cannot patch today
php.net states that there are no complete mitigations and updating is the only safe choice. These settings buy time; they do not fix anything.
For CVE-2026-109618, php.net lists:
memory_limit=-1and a lowpost_max_size- request size, field, part, header and nesting limits at the reverse proxy
- cgroup limits to protect availability
- no
RLIMIT_ASorRLIMIT_DATAlimits, which php.net warns against
For CVE-2026-109619, php.net lists:
session.upload_progress.enabled=0- on PHP 8.5,
fatal_error_backtraces=0 - both set in
php.ini, the FPM pool or server config, notini_set()or.user.ini - a restart of every worker afterwards
- fixing fatal errors and timeouts that attackers can reach
The advisory also lists pm.max_requests=1. Hiding errors from output does not help. A web application firewall rule that caps request size adds a layer, but it is not a substitute for the PHP security update.
Is it being exploited?
The honest answer is that sources disagree.
- The PHP Foundation says proof-of-concept code appeared after an embargo leak, but none was functional at release time.
- Sophos (2026) reports exploit attempts and one successful compromise that delivered a Mirai variant.
- watchTowr (2026) reports exploitation in its honeypots on 21 October.
- The Canadian Centre for Cyber Security (2026) says a PoC is public and no active exploitation has been identified.
- CISA's data in NVD shows "Exploitation: None", and we found no KEV listing.
The PHP Foundation also says the CVE IDs leaked on forums on 20 October with wrong details. Public PoC repositories exist, and none we saw has been vetted. Do not run them against production. Plan as though the bugs are exploited.
Checklist
| Step | What to do | Done when |
|---|---|---|
| 1. Inventory | List every server, container and host running PHP | You have a list with owners |
| 2. Check | Run php -v and the PHP-FPM equivalent on each | You know the web build |
| 3. Compare | Match against 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Each server is marked |
| 4. Upgrade | Update packages or images, then restart workers | The new build is serving |
| 5. Verify | Re-check the version or the distro changelog | The fix is confirmed |
| 6. Interim | Apply php.net settings where you cannot patch yet | Settings are in config files |
| 7. End of life | Plan off 8.1 and older; 8.2 support ends 31 Dec 2026 | A date is agreed |
If your PHP runs on a site we built, or one somebody else built, our website maintenance services cover core and security updates on a schedule. Hands-on patching for applications runs under Support & Maintenance.
Common questions
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released by the PHP project on 21 October 2026. Any earlier release on those four branches is affected. A Linux distribution may ship the fix under an older version number, so check the package changelog as well as the number.
PHP 8.1 and older are end of life and get no official release. The PHP project does not list them as affected, but they are unsupported, so assume they are vulnerable. php.net links source backport branches for 7.4, 8.0 and 8.1, and some distributions, such as Ubuntu 22.04, have patched their own 8.1 packages.
No primary source says so. The PHP project's advisories list PHP 8.2 and later as affected. The claim about PHP 5 onward appears in a DigitalOcean post and is not repeated by php.net, the GitHub advisories or NVD.
The sources disagree. Sophos and watchTowr report exploitation attempts and at least one compromise. The PHP Foundation found no working exploit at release, the Canadian Centre for Cyber Security reports no active exploitation, and CISA data in NVD shows none. Patch as though it is exploited.
Only partly. php.net says there is no complete mitigation and that updating is the only safe choice. Interim settings such as session.upload_progress.enabled=0 and a low post_max_size reduce exposure, but they do not close the bugs.
Law and guidance as at 23 October 2026. This is general information, not legal advice.