On 20 October 2026 the PHP security team gave advance notice of a security release covering two critical vulnerabilities, both rated CVSS v4.0 9.2. The release was published on 21 October 2026, shortly before its scheduled time of 14:00 UTC (3pm UK time). This post sets out what the fixes are and what I did.
What was fixed
- CVE-2026-109618: remote code execution through out-of-memory handling and request cleanup. PHP can be interrupted while internal request data is only partly initialised, and cleanup then treats it as valid.
- CVE-2026-109619: remote code execution through stale request state. State can outlive its freed memory and be reused by a later request on the same worker. The confirmed paths involve session upload progress and, on PHP 8.5, fatal error backtraces.
- Both can be triggered without authentication. PHP reports a demonstrated exploit for the mod_php case. I have seen no reports of exploitation in the wild.
Fixed versions
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also published source backports for 7.4, 8.0 and 8.1, which no longer receive normal releases. See the PHP announcement and the advisories for CVE-2026-109618 and CVE-2026-109619.
PHP says its listed workarounds do not make a server safe. Updating is the only complete fix.
What I did
Before the release I reviewed production servers read-only for signs of compromise, and found none. When the fixed builds were published I updated the production servers to them, checked the running PHP version on each, and confirmed the sites responded.
Not every package repository carried the fix straight away. Where a distribution or panel repository was behind, I used the PHP maintainer's own repository for the same build instead of waiting. I also checked that the extensions each site relied on were still present after the change.
Until the fix was installed, I applied PHP's own interim setting to turn off session upload progress. It reduces exposure to one path of the second flaw and is not a substitute for updating.
What to do on your own servers
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor package that includes the fix.
- Restart PHP-FPM or your web server afterwards, and confirm the running version, not only the installed one.
- If you are on PHP 8.1 or older, move to a supported branch. See my note on why keeping PHP up to date matters.
- If you change package source, check which extensions the old build included, such as Redis or Imagick, before you restart.
If you host with us, this is handled. If you host elsewhere and want a second pair of eyes, get in touch.