What happened
PHP released four security builds on October 21, 2026 that fix two critical unauthenticated remote code execution flaws. The fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and carry a CVSS v4.0 score of 9.2 each. The flaws are tracked as CVE-2026-109618 (out-of-memory corruption in request handling) and CVE-2026-109619 (stale global state that survives after request memory is freed).
Update, October 22, 2026
CloudLinux reported that Imunify360 servers with the web application firewall enabled received rulesets 8.83 through 8.85 automatically on October 21. On ModSecurity (Apache and Nginx) and Coraza, they block the known exploit requests and the public exploit tool. On LiteSpeed, ruleset 8.84 added blocking rules for the tool and for upload progress requests that do not come from the site’s own pages. CloudLinux calls this a virtual patch: it stops known request patterns at the server edge while the vulnerable PHP code stays as it is, so it is an interim mitigation, not a fix.
The same post confirms that fixed ea-php packages for cPanel EasyApache 4, ea-php52 through ea-php85, are released. PHP 8.1 and older get no release from the PHP project; its security team published minimal source backports for PHP 7.4, 8.0 and 8.1.
What we did: our client hosting runs Imunify360 with its web application firewall, which receives these rulesets automatically. On October 22 its ruleset read 8.86, past the 8.85 release CloudLinux lists for these flaws. The firewall rules are a second layer, not the fix: we patched PHP across our web servers, and every system we run with PHP was updated by the morning of October 22.
If you run Imunify360, check that your ruleset is 8.85 or later. Updating PHP is still the only complete solution, according to the PHP project.
Are you affected?
According to PHP, all installations serving web requests may be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk reported on mod_php. The affected versions are below 8.2.35 on the 8.2 branch, below 8.3.36 on the 8.3 branch, below 8.4.27 on the 8.4 branch, and below 8.5.12 on the 8.5 branch. PHP 8.1 and older receive no release from the PHP project; its security team published minimal source backports for PHP 7.4, 8.0 and 8.1, and Linux distributions and LTS vendors may provide their own backported packages. The UK NCSC’s alert advises not to limit discovery to older release branches and to identify PHP installations generally, including in appliances and services that bundle PHP as a component. On Ubuntu, Canonical shows how to list the installed interpreter packages with apt list '?installed ?name(^php[0-9.]+$)'.
What to do now
- Inventory every PHP installation across client infrastructure, including internet-facing systems, containers, vendor appliances and services that bundle PHP. Check the active runtime, the installed package version and the web-serving configuration on each system.
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching the active branch, using the package your distribution or vendor provides. On Ubuntu, Canonical’s guidance is to run
sudo apt updateandsudo apt upgrade, or target the interpreter packages withsudo apt install --only-upgrade '?name(^php[0-9.]+$)', then restart the affected service or reboot. - Restart the web servers and PHP workers so the new build is loaded, then verify the active version. On Imunify360 hosts, confirm that the WAF ruleset is at 8.85 or later, which CloudLinux says arrives without any action on hosts with the WAF enabled.
- Plan the move off PHP 8.2, which reaches end of life on December 31, 2026, and off PHP 8.1 or older, which no longer receive releases from the PHP project. Ask the operating-system or support vendor about backports for any release the PHP project no longer ships, or arrange an upgrade to a supported branch.
- If patching must wait, consider PHP’s interim settings: for CVE-2026-109618, set memory_limit=-1 in configuration applications cannot override, set a low post_max_size, and enforce request size, part count, header count and nesting depth limits at the web server or proxy; for CVE-2026-109619, set session.upload_progress.enabled=0 in configuration that applies before request parsing and restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0 and restart every worker. According to PHP, these measures may reduce exposure to specific paths but do not make an installation safe.
What we’re seeing
Review your inventory records for each site’s runtime and patch status, and investigate any status that cannot be determined.
Sansec says every known trigger is a multipart/form-data request, the format browsers use for file uploads, and PHP parses that body before store code runs.
Why an agency-wide PHP check matters
PHP runs beneath WordPress, Drupal, Joomla, MediaWiki, Magento, Shopware and WooCommerce, so according to Sansec’s research, a flaw in the PHP engine can compromise a website even when the application code above it is clean. Sansec’s research lists unauthenticated RCE confirmed against Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS. Cloudflare reported early attacks at 07:43 UTC on October 21, before the 14:00 UTC release. Wiz Research rates these among the most severe vulnerabilities discovered in PHP, says they affect every PHP version released in the last decade back to 5.4, and warns that a flaw in the core engine may put every affected website at immediate risk. Keep a per-client record of runtime and patch status, including for systems managed by other vendors.
What happens after the update?
Confirm the new version is active, restart the relevant web servers and PHP workers, and test normal application functions such as forms, uploads, publishing and checkout where applicable. Continue monitoring web-server and PHP logs for suspicious activity. The FBI guidance quoted in WIRED tells operators who find signs of compromise to isolate the system, preserve the web-server and PHP logs, and report the incident through their local FBI field office. The NCSC also asks organizations to keep monitoring third-party vendors for new packages that address the flaws, since appliance and bundle vendors ship fixes on their own schedule. Cisco’s advisory is one example: it lists Cisco products under investigation and will be updated as Cisco confirms which products are affected.
FAQ
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
The same advisory notes that Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.
Who is affected by the October 2026 PHP security release?
PHP says installations serving web requests may be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest reported risk on mod_php. According to PHP, applications and vendor products running affected PHP versions can also be exposed. The UK NCSC’s alert recommends identifying PHP installations generally, including in appliances and services that bundle PHP, rather than limiting discovery to older branches.
Can a web application firewall replace patching PHP?
No. CloudLinux describes the Imunify360 firewall coverage as a virtual patch and an interim mitigation, not a fix, and states that only the PHP update may close the flaws.
Sources
Want help with this in Myrtle Beach or Long Island? Talk to us.
NewSunSEO
Grow in Google and AI Search
AI-SEO, local search, paid ads and websites from one team, with offices on Long Island and in Myrtle Beach.
- AI-SEO
- Local AI-SEO
- AI Consulting
- PPC
- Web Design
- Web Development
- Long Island Office(631) 320-1700
- Myrtle Beach Office(843) 492-7131
Request a Free Proposal
Tell us about your business and where you want to grow.
We will reply by email to talk through your goals and what a proposal would include.
We use your details only to reply to you and send what you asked for. See our Privacy Policy.
