Critical PHP Security Update: Two RCE Flaws Fixed in 8.5.12, 8.4.27, 8.3.36 & 8.2.35

What Was Released: Patched PHP Versions at a Glance

PHP released security fixes for four supported branches. If your website runs on an earlier, unpatched release within these branches, an update is necessary.

PHP 8.2 will also reach its end of life on December 31, 2026. Businesses using this version should plan an upgrade to a newer supported branch.

Who Is at Risk from These PHP Vulnerabilities?

Websites and applications using vulnerable PHP versions to process web requests may be at risk, regardless of the framework or content management system they use.

Highest Risk: Apache mod_php

According to the PHP security advisory, Apache servers using mod_php face the highest confirmed risk.

Researchers demonstrated an attack that can be triggered through an unauthenticated request before the application's code starts running. This means normal website-level security measures may not prevent the attack.

Other Affected Setups (PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)

Other PHP environments, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, also require security updates.

Even if your WordPress plugins or website applications are up to date, an outdated PHP runtime can leave the server vulnerable.

The Two Critical Vulnerabilities Explained

The security update addresses two problems involving how PHP handles memory and request-related information.

CVE-2026-109618: RCE via Out-of-Memory Corruption

This vulnerability occurs when PHP encounters an out-of-memory condition while processing a request.

If certain internal data remains incomplete, PHP may incorrectly handle it during cleanup, resulting in memory corruption.

Under exploitable conditions, an attacker could use this weakness to execute malicious code remotely.

CVE-2026-109619: RCE via Stale Global State

This vulnerability involves PHP retaining internal request information after the memory associated with it has been released.

When the same PHP worker processes another request, it may access outdated information before normal initialisation resets it.

This can create a security weakness that potentially allows remote code execution.

Both vulnerabilities are serious because they affect the PHP runtime itself, not simply an individual website's code.

How to Update PHP Safely

Updating PHP is the most effective way to protect your website from these vulnerabilities. However, installing a new version without checking compatibility can affect website functionality. Follow these steps to update PHP safely.

Update to the Patched Version for Your Branch

First, identify the PHP version installed on your server. If you have command-line access, run:

php -v

This displays the command-line PHP version. Since your website may use a different PHP installation, verify the version configured for your web server as well.

If your installation is affected, update to the appropriate patched version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Before updating, back up your website files and database. For business-critical websites, test the update in a staging environment to identify compatibility issues.

Linux, Windows and Hosting Providers

The PHP update process depends on your operating system and hosting environment.

For Linux Servers

Install the patched PHP packages from your distribution or PHP repository.

On Debian or Ubuntu:

sudo apt update
sudo apt upgrade

On RHEL, AlmaLinux or Rocky Linux:

sudo dnf upgrade 'php*'

Because distributions often backport the fix without changing the version number, confirm the fix by checking the package changelog for the CVE ID.

Debian/Ubuntu (replace with your package name):

zgrep CVE-2026-109618 /usr/share/doc/php8.3-fpm/changelog.Debian.gz

RHEL-based distributions:

rpm -q --changelog php-fpm | grep CVE-2026-109618

If you use the volunteer-run Remi repository, the PHP team warned it would not have updates on release day. Check that patched packages are available, or switch to your distribution's packages.

For Windows Servers

Download the appropriate patched PHP binaries from the official PHP downloads page.

Select the compatible build, follow the PHP installation instructions and verify that your web server is configured to use the updated version.

For Shared or Managed Hosting

On shared and managed hosting, your provider controls PHP, so the fix has to come from them. Switching PHP versions in cPanel or your host's dashboard only changes which version you use; it doesn't install the fix. Many hosts also patch the version you already run, so the version number may stay the same.

Here is what major providers had said as of 23 October 2026:

If your host isn't listed, or hasn't said anything, open a support ticket and ask:

1. Is the fix for CVE-2026-109618 and CVE-2026-109619 installed on the server hosting my site?
2. Does it cover every PHP version on my account, including older ones?
3. Have you checked for signs of exploitation since mid-October?

Restart Workers and Verify Your Version

After updating PHP, restart or reload the relevant PHP workers and web server services so they use the updated runtime.

Verify the PHP version again using:

php -v

Also confirm the version serving your website, since it may differ from the command-line installation.

Finally, test important website features, including login pages, contact forms, payment processing, file uploads and third-party integrations. Review server error logs to identify any issues following the update.

Completing these checks helps ensure your website is running the required security patches without affecting its regular operations.

Still Running PHP 8.1 or Older?

PHP 8.1 and earlier versions no longer receive regular upstream security updates. Businesses using these versions should review their available support options.

Vendor Backports and LTS Options

Some Linux distributions and long-term support vendors provide security fixes for older PHP versions.

If your hosting environment uses such packages, confirm that the vendor has addressed both reported vulnerabilities. Otherwise, plan an upgrade to a supported PHP branch.

Source Backports for PHP 7.4, 8.0 and 8.1

The PHP security team has provided minimal source backports for PHP 7.4, 8.0 and 8.1 because of the severity of these vulnerabilities.

These fixes are intended for administrators building PHP from source or without access to suitable vendor packages. They do not replace the need to migrate away from unsupported versions.

Can't Update Yet? Temporary Mitigations

If an immediate update isn't possible, the PHP security team has recommended temporary configuration measures to reduce exposure to known attack paths.

Mitigations for CVE-2026-109618

For the out-of-memory vulnerability, administrators can consider:

• Setting memory_limit=-1 at a server-controlled configuration level.
• Restricting post_max_size based on application requirements.
• Keeping upload_max_filesize below post_max_size.
• Applying suitable request and resource limits.

These changes require careful server-level configuration because they may affect memory consumption and website functionality.

Mitigations for CVE-2026-109619

For the stale global state vulnerability, PHP recommends disabling session upload progress using:

session.upload_progress.enabled=0

For PHP 8.5, the advisory also recommends:

fatal_error_backtraces=0

These settings must be applied at the appropriate server configuration level, followed by restarting affected PHP workers.

Why Mitigations Are Not a Fix

Temporary measures reduce exposure to specific attack methods but do not eliminate the underlying vulnerabilities.

Updating to a patched PHP version or verified security-backported package remains the only complete solution.

Key Takeaways for Developers and Site Owners

The October 2026 PHP security release highlights a few important points:

• Two critical vulnerabilities could allow unauthenticated remote code execution.
• Apache mod_php faces the highest confirmed risk, but other PHP environments also require updates.
• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the security fixes.
• Websites running unsupported PHP versions need verified vendor fixes or an upgrade.
• Temporary mitigations cannot replace security patching.

PHP Security Update Checklist

Before considering your website secure, verify the following:

• Check the PHP version running on your website.
• Confirm whether your PHP installation has received the necessary security patches.
• Back up website files and databases.
• Test and install the appropriate PHP update.
• Restart relevant PHP workers and server services.
• Verify the update and test website functionality.
• Plan migration if you're running an unsupported PHP version.

Conclusion

The October 21, 2026, PHP security update addresses two critical vulnerabilities that website owners and developers should not ignore. Even a well-maintained website may be exposed if its underlying PHP runtime is outdated.

Checking your PHP version, applying security patches and testing your website after the update can help reduce these risks. Staying current with PHP security releases is essential for maintaining a secure and reliable website.