Critical PHP vulnerability: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now
On 21 October 2026 the PHP team released security updates for all supported versions. They fix two vulnerabilities that let attackers run code on the server without logging in. This update takes priority over everything else.
What happened
Both vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are rated CVSS 9.2. They sit in PHP's own request handling, before any application code runs. A framework like Symfony or Laravel does not protect against them.
- CVE-2026-109618: if PHP runs out of memory during a request, internal data can stay half initialized and later be treated as valid during cleanup.
- CVE-2026-109619: internal state of a request can survive after its memory has been freed and be used by the next request on the same worker.
Who is affected
Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates the risk highest for mod_php, where an unauthenticated exploit has been demonstrated.
What to do now
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so packages should be available.
- Restart every worker (PHP-FPM, Apache, FrankenPHP) so the new version actually runs. php -v on the command line only shows the CLI version, not necessarily the one behind the web server.
- Rebuild and redeploy container images, even if the code has not changed.
- If you use rpms.remirepo.net: the PHP team recommends switching to distribution packages or building from source, because the repository did not have the updates right away.
If you cannot update right away
The PHP team lists settings that block individual attack paths. They explicitly do not make an installation safe and only bridge the time until the update:
- Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not via ini_set() or .user.ini) and restart every worker.
- On PHP 8.5, also set fatal_error_backtraces=0.
- Keep post_max_size low (8M without file uploads, 32M otherwise) and limit request sizes at the web server or proxy.
PHP 8.1 and older
PHP 8.1 and older no longer receive updates from the PHP project. Given the severity, the PHP team still published minimal patches for 7.4, 8.0 and 8.1 this time, but only as source code to build yourself. Some distributions and LTS vendors ship backports.
That is an exception you cannot count on next time. Now is a good moment to plan the migration to a supported version. PHP 8.2 also reaches end of life on 31 December 2026. The supported versions are listed on php.net/supported-versions.php.
Sources
- php.net: security advisory of 21 October 2026
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- php.net: supported versions
Related services: PHP migration Symfony maintenance