PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution. PHP-FPM users need to update too.
The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or vendor packages containing equivalent fixes.
I covered the advisories and the European response in my full article on Medium. Here are the deployment checks from it.
Check the version your website actually uses
First, verify the PHP runtime serving web requests. php -v checks your command-line installation; your website may use a different version.
Then check every deployed instance: containers, additional servers, staging environments exposed to the internet, and older applications still running quietly somewhere.
Install the update, restart the relevant services or replace the containers, and confirm the running workers use the patched build. Test the application's important flows after deployment.
A vendor may patch an older package without changing its upstream version number. Check its security notice before relying on the number alone.
Updating Composer or your project dependencies does not install these PHP runtime fixes.
If someone else manages your hosting
Send them the advisory and ask them to confirm which patch is running. If you manage the servers yourself, check the deployed environments before closing the ticket. It is easy to update one machine and leave another behind.
PHP's official announcement has the update instructions and the limits of temporary mitigations.
Have you received confirmation from your hosting provider, or are you still waiting for the patched packages?
Top comments (0)