PHP Security Vulnerability CVE-2026-109618: How to Close It

On 21 October 2026, the PHP project closed two critical security vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both allow attackers without authentication to run code on the web server over the network (CVSS 9.2). The only complete remedy is to update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and then restart all PHP processes.

Here you will read how to check in a few minutes whether your website is affected, install the update, and prove that no old PHP process is still running. We installed the updates on our own servers the same evening; the verification steps below come from that work.

What do I need to do now?

You run your own server or virtual server:

1. Check the PHP version (section below).
2. Install the update for every installed PHP version.
3. Restart PHP-FPM or Apache.
4. Prove that no old PHP process is still running.
5. Look for traces of an attack if the server was exposed for a longer time.

Your website is with a hosting provider (shared hosting, WordPress hosting):

1. Look up your website's PHP version in the hosting panel or in WordPress.
2. Ask the provider whether the update was installed and PHP was restarted.
3. If your site still runs on PHP 8.1 or older: switch to PHP 8.3 or newer in the panel.

What happened?

On 21 October 2026 at 14:00 UTC, the PHP project released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The announcement on php.net is titled "Critical remote code execution vulnerabilities, update now". For you, this means that since that afternoon the vulnerabilities have been publicly documented, and every server without the update is a known target.

Which PHP versions are affected?

All versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected. Exactly these four versions and every later one are safe.

For PHP 8.1 and older, php.net refers to the respective vendor. Whether a vendor has backported the fix is for that vendor to prove. The safe route is to switch to PHP 8.3 or newer, because according to php.net, PHP 8.2 only receives security updates until 31 December 2026.

How do I check my PHP version?

What matters is the version your website runs on, not the one on the command line. The two can differ, because several PHP versions are often installed in parallel.

• Hosting panel (Plesk, cPanel): The PHP version is usually shown in the settings of the respective domain.
• WordPress: "Tools → Site Health → Info → Server" shows the version the site actually runs on.
• Own server (Debian, Ubuntu): php-fpm8.4 -v shows the version of the FPM service, dpkg -l 'php8.4*' the installed packages. With Plesk, each version is located under /opt/plesk/php/<Version>/bin/php.

Distributions sometimes fold the fix into their own version number, for example with a suffix such as ~deb12u1. In that case, the distribution's security advisory is what counts, not the plain upstream number.

How dangerous is the vulnerability for my website?

The vulnerability is serious because an attack needs neither an account nor a click from the victim. All statements in this section come from the two advisories and the announcement on php.net (sources below).

• Apache with mod_php: Here the attack is fully demonstrated. A request without authentication can trigger it before your application code even runs. A security plugin in WordPress therefore does not help.
• PHP-FPM (typical with nginx and many hosting providers) and php-cgi: also at risk. For FPM, the vulnerability is established in the source code, but a complete attack has not been demonstrated.
• FrankenPHP and LiteSpeed: also on the list of installations at risk.

CVE-2026-109618 is triggered, for example, through a crafted form with a file upload (multipart) that makes PHP exhaust its memory. A successful attacker runs with the privileges of the web server account. With that, they can as a rule modify the website's files and read the database credentials from the configuration.

Is this a zero day?

According to the published information, not in the strict sense. Neither the advisories nor php.net report that the vulnerabilities were exploited before the patch. However, on 20 October the PHP project had reserved the right to publish earlier if attacks appeared. Since 21 October the technical details have been public, and experience shows the window until the first attacks is short.

How do I close the PHP security vulnerability?

You close the vulnerability in three steps: install the update, restart the PHP processes, measure the result. The second step is the one most often forgotten.

1. Install the PHP update

On Debian and Ubuntu, the update comes through the package manager; with a hosting panel (Plesk, cPanel), through its update function:

sudo apt update
sudo apt install --only-upgrade 'php8.4*'

Replace 8.4 with your version, and repeat the step for every installed PHP version. Even a version that no website currently uses can still be running as a service.

2. Restart PHP-FPM

An update only replaces the files on disk. Running PHP processes keep working with the old, vulnerable version in memory. That is why a restart belongs after every update:

sudo systemctl restart php8.4-fpm   # PHP-FPM
sudo systemctl restart apache2      # nur bei mod_php

3. Check that the new version is really running

The most reliable method is to search for processes that still have a deleted, that is, old PHP file loaded:

sudo ls -l /proc/*/exe 2>/dev/null | grep -i 'php.*(deleted)'
sudo grep -l 'libphp.*(deleted)' /proc/*/maps 2>/dev/null

If both outputs stay empty, no PHP process is running with the old version any more. On Debian and Ubuntu, sudo needrestart -r l additionally shows which services still use old libraries. With this method, we found processes on our servers that would have kept executing old code without a restart.

4. Check for traces

If your server was reachable without the update for a longer time, it is worth looking at these three places:

• Logs: The advisory on CVE-2026-109619 mentions the logs of Apache, PHP-FPM and the reverse proxy, for example PHP warnings before the actual script or "Maximum execution time exceeded". According to the advisory, however, a missing entry is no proof of safety.
• Changed files: find /var/www -name '*.php' -newermt '2026-10-21' lists PHP files changed since 21 October. Your own deployments show up there too; anything you cannot account for is suspicious.
• Upload folder: PHP files in folders that should only contain images and documents (in WordPress wp-content/uploads) are a warning sign.

What if I cannot update immediately?

Then you can reduce the attack surface, but not close it. According to php.net, these mitigations leave an installation "not safe". They are a bridge until the update. All points come from the two advisories, and each setting only takes effect after a restart of the PHP processes.

• Limit form input:
  • Keep post_max_size small and limit the request size at the web server or proxy already.
  • Lower max_input_vars and max_input_nesting_level.
  • Limit the number of uploads and form parts.
• Block file uploads where none are needed: If the application does not use multipart forms, the web server can reject them.
• Switch off upload progress: session.upload_progress.enabled=0. This also makes sense after the patch if you do not need the feature.
• Let workers live briefly: pm.max_requests=1 in PHP-FPM limits how long old state survives in a process. This costs performance.
• Remove the memory limit (it sounds wrong, but it is so): memory_limit=-1 is the most important setting against CVE-2026-109618, but expressly incomplete. It takes away the attacker's predictable limit at which they trigger the memory shortage. The price: a single request can then use as much memory as the server has.
• No RLIMIT_AS or RLIMIT_DATA: These limits make the memory request fail and lead exactly into the vulnerable path.

Frequently asked questions about the PHP security vulnerability

Is WordPress affected by the PHP vulnerability?

Yes, if the website runs on an unpatched PHP version. The vulnerability is in PHP itself, not in WordPress, a plugin or a theme. A WordPress update does not close it.

Do I have to update every installed PHP version separately?

Yes. Each branch (8.2, 8.3, 8.4, 8.5) is its own package with its own service. On servers with a hosting panel, several versions often sit side by side, and each needs its update and its restart.

Is restarting the web server enough?

Not with PHP-FPM: restarting nginx or Apache does not reload PHP. You must restart the FPM service of each version, for example php8.3-fpm and php8.4-fpm.

How can I tell that my hosting provider has restarted PHP?

From the outside, not reliably. Ask explicitly about the update and the restart. In WordPress, Site Health shows the new version number after the restart.

Is there a configuration that closes the vulnerability completely?

No. Both advisories name the update as the only complete remedy.

Help with patching

Do you run several servers or a custom PHP project and want to be sure that nothing is still running with the old version? In a code and security audit, we examine your application and its runtime environment. For a quick assessment, you can reach us through the contact form.

Sources

• GitHub Security Advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
• GitHub Security Advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
• php.net: Security advisory: Critical remote code execution vulnerabilities, update now (21.10.2026)
• php.net: Upcoming Critical PHP Security Release (20.10.2026)
• php.net: PHP 8.2.35 Released (with a note on the end of support on 31.12.2026)

As of 22 October 2026. General technical information without warranty; check the steps on your system before applying them.