A critical PHP vulnerability update released Wednesday, October 21, 2026, addresses two flaws that can allow unauthenticated remote code execution on affected web servers.
The PHP development team issued patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and urged users to update immediately.
The release came at 10 a.m. EDT in Toronto, matching the PHP project’s announced 14:00 UTC emergency release window.
Table of Contents
What the PHP vulnerability update fixes
The first flaw, CVE-2026-109618, involves PHP’s handling of out-of-memory conditions during request processing.
According to the PHP security advisory, certain multipart requests can exhaust memory while PHP is still initializing internal request data.
In vulnerable configurations, request shutdown may then process partially initialized data, creating a path to remote code execution.
The advisory identifies Apache mod_php as the highest-risk deployment because the demonstrated attack can be triggered before application code runs.
PHP-FPM, FrankenPHP and LiteSpeed deployments are also included in the affected installation types, although exploitability and reliability can vary by server configuration.
The second flaw, CVE-2026-109619, concerns stale global state retained by a persistent PHP worker after the memory belonging to an earlier request has been released.
A later request handled by the same worker can potentially cause that stale state to be read, freed or otherwise acted upon before normal request initialization resets it.
The PHP project rates both vulnerabilities as critical and assigns each a CVSS version 4.0 score of 9.2.
Which PHP versions are affected
PHP versions older than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected according to the published advisories.
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older branches no longer receive regular updates from the PHP project.
Some Linux distributions and long-term-support vendors may provide backported security fixes for older branches, so administrators should check their operating-system or hosting provider packages.
Websites using managed hosting, control panels or commercial PHP bundles should confirm that the provider has installed the corrected runtime rather than assuming that a panel update alone is sufficient.
What administrators should do now
Administrators should identify every PHP runtime serving web requests and update it to a fixed release as soon as possible.
After updating, PHP workers should be restarted so that older vulnerable processes are removed from service.
Organisations should also review application, web-server and proxy logs for unusual multipart requests, repeated memory exhaustion, unexpected worker crashes or unexplained command execution.
The PHP project says updating is the only complete mitigation.
For CVE-2026-109618, temporary measures include enforcing conservative request and upload limits, limiting multipart parts and headers, and blocking multipart requests where file uploads are not needed.
For CVE-2026-109619, administrators can disable session.upload_progress before request parsing and restart workers, but the PHP project warns that this blocks only confirmed attack paths and does not make an unpatched installation safe.
Configuration changes applied inside application code or through settings that take effect after request initialization may not protect against the affected early-processing paths.
Why the release matters to website operators
PHP remains a core component of many websites, content-management systems, online stores and internal web applications.
The vulnerabilities are in the PHP runtime rather than in one particular plug-in or application, which means a vulnerable server may require attention even when its website software is fully updated.
Remote code execution can allow an attacker to run commands under the permissions of the web worker, potentially exposing website files, credentials, databases or connected services.
The practical impact depends on server isolation, worker privileges, network access and application configuration.
There was no official confirmation in the PHP release notice that the flaws had been exploited in the wild at the time of publication.
However, public technical information and proof-of-concept material can increase pressure on unpatched systems, making rapid inventory and patching important.
What happens next
Hosting companies, Linux distributors and control-panel vendors are expected to roll the fixes into their supported PHP packages.
Organisations that cannot patch immediately should apply the temporary controls described by PHP, increase monitoring and set a short deadline for completing the upgrade.
Security teams should treat unsupported PHP branches as a separate remediation problem because the main PHP project does not provide ordinary security updates for them.
Frequently Asked Questions
What is the PHP vulnerability patched on October 21, 2026?
The PHP project patched two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution.
Which PHP versions fix the vulnerabilities?
The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Are PHP-FPM servers affected?
PHP-FPM installations are included among the affected deployment types, although the exact exploitability depends on configuration and request handling.
Is disabling session.upload_progress enough?
No. Disabling session.upload_progress can reduce exposure to confirmed paths for CVE-2026-109619, but PHP says upgrading is the only complete mitigation.
What should website owners do first?
Identify the PHP version serving each site, install a fixed package, restart PHP workers and review logs for unusual requests or worker activity.
Fact-Checked: Key release, version, severity and mitigation details were checked against the PHP project’s official security advisory and linked PHP security advisories. ([php.net](https://www.php.net/archive/2026.php))
Disclaimer: Temporary configuration measures can reduce exposure but do not replace upgrading to a fixed PHP release.