PHP Vulnerability October 2026: Patch CVE-2026-109618 and CVE-2026-109619

On 21 October 2026 the PHP team published an out-of-band security release at 14:00 UTC. It fixes two flaws in the core of the language. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution. An attacker needs no account, and nothing in your application has to be misconfigured.

The existence of the flaws had leaked the day before, which is why the release landed earlier than planned. CISA published an alert the same day and calls the flaws “php2shell”. Work from the advisory on php.net. The summaries circulating since 20 October mix confirmed details with speculation.

Two flaws in request state

CVE-2026-109618 triggers when PHP runs out of memory. Cleanup can run while internal request data is only partly initialised. It then treats that incomplete data as valid and uses it as a write target.

CVE-2026-109619 lives between two requests. A request leaves internal state that points at memory PHP later frees. When the same worker handles the next request, it can use that stale state before initialisation resets it.

Both flaws sit below the application. The software on top does not matter, and clean application code does not help.

Who is affected

Any installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk, because an unauthenticated request can trigger the attack before application code runs.

PHP 8.1 and older no longer receive updates from the PHP project. For 7.4, 8.0 and 8.1 there are minimal source backports, meant for anyone who builds from source or has no LTS vendor. Distributions and commercial vendors ship their own packages; check their notes before you compile. One exception: rpms.remirepo.net will not have updates on release day. The PHP team urges users to switch to distribution packages or build from source.

PHP 8.2 reaches end of life on 31 December 2026. Patching to 8.2.35 buys ten weeks and the same problem after that. Plan the version jump in the same maintenance step.

PHP also runs in places that do not say PHP on the box. CISA notes that its prevalence is often not directly visible because PHP ships inside other software. Inventory container images, hosting panels and managed services before you patch.

What to do today

1. Take inventory. Check php -v inside the running container, not in the package manager, plus FPM pools, Apache modules and the images your deployments build from.

2. Patch, internet-facing systems first: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Restart workers and the web server afterwards. Without a restart the old processes keep running, opcache included.

3. Verify the fix. The version in the running process has to be the new one. An apt upgrade and a php -v on the host say nothing about the container answering requests.

4. If an update is not possible today, the advisory lists mitigations. They close individual attack paths and do not replace the update:

   • memory_limit=-1 via php_admin_value in the FPM pool or Apache config, then check that no pool, directory or application setting puts a limit back.
   • post_max_size at 8 MB without uploads, 32 MB with them, upload_max_filesize below that. Add proxy limits for request size, field count, multipart parts, headers and nesting depth, including requests without a usable Content-Length.
   • A container or cgroup limit as an availability boundary, with a policy that kills only the affected worker. Do not use RLIMIT_AS or RLIMIT_DATA for this; they can cause the exact allocation failure that reaches the vulnerable path.
   • session.upload_progress.enabled=0 set in php.ini, the FPM pool or the server config, then restart every worker. ini_set() and .user.ini apply too late.
   • On PHP 8.5 also set fatal_error_backtraces=0 and restart. That closes the confirmed path; other variants remain open.
   • Fix fatal errors and execution timeouts an attacker can reach. Hiding diagnostics does not help.

5. Watch. CISA recommends looking for PHP workers that spawn shells or download tools.

Patching happens below the CMS

This flaw forms between two requests, where a worker reuses memory. A CMS update and a code review do not reach that layer. Treat PHP as a dependency of the CMS and you update the CMS while the runtime keeps running.

Security firms expect attacks within hours of a release this severe. A patch in the next maintenance window arrives late.

Fixed dates add pressure. PHP 8.1 has no support, and PHP 8.2 ends in ten weeks. Each of those dates turns a maintained installation into an unpatched one without anyone making a mistake.

What we handle

We run continuous security monitoring for your servers: update and patch management for the runtime, service monitoring, verification that backups can actually be restored, and a fixed order of operations when a flaw like this one is published. You hear about it from the team that patches the servers anyway.

If you want to know whether your servers are affected and who patches them today, send us the PHP version and the number of servers.