Critical PHP Security Flaws: Which Versions to Install

If you operate a PHP website, check that its web-serving runtime has received the October security fixes. On October 21, the PHP project announced updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution without authentication. Both have a CVSS v4.0 score of 9.2. The PHP security advisory  urges administrators to update immediately.

These are flaws in PHP itself. Correct application validation, authentication, or HTML escaping does not repair the underlying runtime.

What went wrong?

CVE-2026-109618  concerns out-of-memory handling. If an allocation fails while request data is only partly initialized, cleanup can act on invalid memory. PHP documents a working unauthenticated exploit against Apache mod_php, including a path that runs before application code starts.

CVE-2026-109619  concerns stale internal state. A worker can retain references to memory freed after one request, then use them while starting another. The exact conditions depend on the affected state, configuration, and request path.

The PHP advisory includes PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP, and LiteSpeed among the installations requiring attention. It identifies mod_php as the highest-risk deployment. Different execution models have different exposure conditions; using FPM is not a reason to skip the update.

Which versions contain the fixes?

The following are the first fixed releases for the maintained branches, as listed in the PHP advisories:

Install the appropriate security-supported package containing these fixes, or a later fixed release. Distribution maintainers may backport patches while retaining an older upstream version number, so check the security notice for your operating system, package repository, or hosting provider.

PHP 8.1 and older no longer receive normal upstream releases. The PHP team has nevertheless linked minimal source backports for 7.4, 8.0, and 8.1 in its advisory. Those emergency patches do not restore maintained status: use a vendor-supported patched build or plan a move to a supported branch. PHP 8.2’s upstream security support ends on December 31, 2026, according to the supported-versions schedule .

How the incident developed

The PHP Foundation’s account  gives more context than a single emergency-release date:

• 2024: work following an external audit revealed early signs of the out-of-memory problem. The Foundation describes compatibility concerns, limited resources, and a stalled decision process that delayed a fix.
• August 2026: reports demonstrating remote code execution made the impact clearer and moved the work to top priority.
• October 20: the PHP security team gave advance notice of the critical release.
• October 21: PHP announced the fixed releases and published the security advisories.

The release notices and Foundation account date the release to October 21; the PHP 8.5.12 changelog  currently labels its entry October 22. The timeline here follows the announcements.

What to check on your servers

1. Identify the runtime serving each website. php -v identifies command-line PHP, which may differ from an FPM pool, Apache module, container, or hosting-panel selection. Include every deployed instance and image.
2. Update and restart or replace workers. Confirm the running web runtime uses the patched package. Installing a package while old workers remain alive is not enough.
3. Reduce exposure while arranging an update. Restrict access where practical and follow the PHP advisory and your provider’s guidance. PHP’s temporary configuration mitigations address particular paths; they are not a complete substitute for patching.
4. Review signs of compromise. Investigate unexpected files, processes, requests, and worker failures with your security team or host. A successful upgrade does not establish that an earlier compromise never occurred.
5. Test application behavior afterward. Check logins, sessions, forms, uploads, scheduled tasks, and API endpoints on the updated runtime.

For repeatable functional checks, use the cURL command builder. The cURL command guide covers request options; JSON vs Form Data vs Multipart helps reproduce the request format your application actually receives. The browser Network inspection guide can help investigate a form or login that behaves differently after deployment.

These are functional checks. HTTP responses cannot, by themselves, prove that a PHP interpreter is patched or that a server has not been compromised.

Status on October 23, 2026

Fixed releases are available, and the advisories document exploit demonstrations. That evidence establishes urgency, not a count of compromised websites. This article does not estimate the scale of exploitation or establish the status of any individual server.

For an administrator, the next useful step is to verify the patched runtime on every web-serving instance, then complete the application and incident checks appropriate to that environment.