On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS score of 9.2. They affect PHP's core request-handling and memory-management behavior, making this an important security update for teams running PHP-powered applications.
If you manage PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP, or another PHP runtime, verify your environment and apply the appropriate vendor-supported security updates as soon as possible.
Official references:
Understanding the Two Vulnerabilities
1. CVE-2026-109618: Remote Code Execution Through Memory Corruption
This vulnerability involves PHP's handling of out-of-memory (OOM) conditions during request processing.
When an OOM error interrupts request parsing, some internal request structures may remain partially initialized. Cleanup routines can then encounter invalid or unexpected memory references.
Under the right conditions, an attacker may exploit this behavior to achieve remote code execution.
Why it matters: Applications exposed to untrusted HTTP requests may be at risk even when their application-level authentication and authorization controls are correctly configured.
2. CVE-2026-109619: Remote Code Execution Through Stale Global State
The second vulnerability concerns request-owned internal state that can persist after its backing memory has been released.
In affected worker-based environments, a subsequent request may encounter stale state before normal initialization resets it.
This creates an opportunity for memory corruption and potentially remote code execution.
Why it matters: Long-running PHP workers make runtime-level security particularly important. Application code alone cannot reliably compensate for a vulnerable PHP interpreter.
Which PHP Versions Should You Update?
The PHP project published security fixes for these release branches:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older are no longer supported by the upstream PHP project. Some operating-system vendors may provide backported security fixes, so check your vendor's advisory before deciding whether an installation is protected.
These are the upstream fixed versions. Confirm the security status of your actual installed package with your distribution or hosting provider.
Practical Remediation Checklist
Step 1: Check the PHP Runtime Serving Your Application
Start with:
php -v
Remember that this reports the CLI version, which may differ from the version serving web requests.
For PHP-FPM on Linux, inspect the running process:
pgrep -a php-fpm
You can also inspect a specific process executable:
readlink -f /proc/<PID>/exe
Replace <PID> with the process ID of the relevant PHP-FPM process.
Check your web server configuration, container image, hosting environment, and package source to identify the runtime actually handling requests.
Step 2: Apply the Appropriate Security Update
Ubuntu or Debian
Update package metadata and identify the PHP packages supplied by your configured repositories:
sudo apt-get update
apt list --upgradable 2>/dev/null | grep php
Upgrade the relevant packages using your distribution's security guidance. Package names and available fixed versions vary by release and repository.
After upgrading, restart the relevant PHP-FPM service if required and verify that the running workers use the updated runtime.
Docker deployments
Review your Dockerfile and update the PHP base image to a verified fixed release appropriate for your application.
For example:
FROM php:8.3.36-fpm
Then rebuild and recreate the affected containers:
docker compose build --pull
docker compose up -d --force-recreate
Test the application before completing the rollout, and verify the version inside the running container.
Step 3: Verify and Monitor
After patching:
- Confirm the running PHP runtime or package contains the appropriate security fix.
- Check application logs for startup errors and unexpected behavior.
- Test critical application routes and background workers.
- Review exposed services and investigate suspicious activity where appropriate.
- Document the affected systems, patch status, and verification results.
A Web Application Firewall may provide additional defensive controls, but it should not be treated as a substitute for applying the security update.
Final Thoughts
This advisory is a reminder that application security depends on more than application code. Runtime versions, operating-system packages, container images, and long-running worker processes all need regular maintenance.
The priority is straightforward: identify exposed PHP runtimes, apply the correct security fixes, and verify that the updated versions are actually running.
For teams maintaining PHP applications, a repeatable patching and verification process can help reduce the risk of leaving critical vulnerabilities unaddressed.
If you're working on improving your application's security, performance, or underlying architecture, explore SCRIPTBAKER to learn more about its web development and software engineering services.
Top comments (0)