In October 2026, the PHP project released emergency security updates for supported PHP branches. The fixes address two critical vulnerabilities that, under realistic conditions, could allow unauthenticated remote code execution (RCE) on servers running affected PHP versions.
This article explains what changed, who should act, and practical steps for developers, DevOps teams, and website owners.
What was fixed?
The PHP security team published patches across maintained versions, including PHP 8.2, 8.3, 8.4, and 8.5. Two issues received widespread attention:
- CVE-2026-109618 — memory handling during out-of-memory (OOM) conditions could leave internal request state inconsistent, which researchers demonstrated could lead to remote code execution in common server setups.
- CVE-2026-109619 — stale global state across requests in long-lived PHP workers could be abused in some configurations.
Official guidance from the PHP project is clear: updating to a patched release is the only complete mitigation. Partial workarounds may reduce risk in edge cases but should not replace patching.
Who is affected?
Any environment that executes PHP for web traffic may be in scope, including PHP-FPM, Apache or nginx with PHP, mod_php, and common CMS stacks (WordPress, Laravel, Drupal, and custom applications).
If your runtime is below the October 2026 security releases for your branch (for example, PHP 8.3 before 8.3.36, PHP 8.2 before 8.2.35, PHP 8.4 before 8.4.27, PHP 8.5 before 8.5.12), treat it as out of date until your vendor confirms equivalent security backports.
What should you do?
1. Identify your real PHP version
Check the version used by the web runtime, not only the command line. Use your host’s control panel, application health tools, or infrastructure inventory—avoid leaving public phpinfo() files on production sites.
2. Apply patched PHP
- Self-managed servers: upgrade packages or rebuild from upstream security releases.
- Managed hosting: use the PHP version selector or confirm with support that the active runtime includes October 2026 security fixes.
- Containers: rebuild images on patched bases and redeploy; restart all PHP workers.
3. Restart workers
After upgrading PHP, restart PHP-FPM, Apache, LiteSpeed, or other process managers so no old binary stays loaded in memory.
4. Patch the application layer
Update CMS core, plugins, themes, and dependencies. Review uploads, authentication endpoints, and WAF rules as part of defense in depth.
5. Verify and monitor
Confirm the live version after deploy, review logs, and follow PHP security announcements and your OS or host security bulletins.
Shared hosting and backported versions
Some providers ship PHP with a stable php -v label while backporting security fixes into the same package stream. You might still see an older minor version number even when critical CVEs are patched—confirm with your provider’s changelog or support, not the version string alone.
Takeaways
- October 2026 PHP releases address critical RCE-class issues; treat them as urgent.
- Upgrade or obtain vendor confirmation of backported fixes.
- Restart PHP workers after runtime changes.
- Combine infrastructure patching with application hygiene and monitoring.
References: PHP 8.3.36 release notes and The PHP Foundation overview.