PHP Critical Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 Explained

The immediate fix is to install a patched PHP release or a vendor package that explicitly fixes both CVEs, then replace or restart the affected PHP workers. If a hosting company manages your server, ask it to confirm that the PHP runtime serving your domain has been patched.

This guide starts with practical steps for hosting customers, followed by update instructions and temporary measures for administrators.

Quick action guide: what should you do now?

Your situation	Recommended action
Shared hosting or managed WordPress hosting	Contact the provider and request confirmation that both CVEs are fixed for your domain.
Managed VPS or dedicated server	Ask the administrator to update every PHP runtime used by your websites and confirm worker replacement.
Self-managed Linux server	Inventory installed PHP builds, install the relevant security packages, and restart the affected services.
PHP running in containers	Deploy a verified patched image and recreate the affected containers.
An old PHP application	Check for a vendor-supported backport while planning migration to a supported PHP branch.
No patch immediately available	Restrict exposure and consider the temporary measures below. They do not provide complete protection.

What do these PHP vulnerabilities mean?

PHP processes the server-side code behind many websites. A flaw in PHP itself can affect a website even when its application, theme, and plugins are up to date.

Remote code execution, often shortened to RCE, means an attacker can make the affected process execute code. The resulting access depends on the permissions of the PHP worker. It does not automatically mean root access, but access to website files or application credentials can still be serious.

CVE-2026-109618: memory corruption during out-of-memory handling

This vulnerability concerns how PHP handles an out-of-memory condition, or OOM. A memory allocation failure can interrupt PHP while internal request data is incompletely initialized. Cleanup may subsequently use that invalid data, making code execution possible. PHP documents a demonstrated Apache mod_php attack that can occur before application code starts; other execution environments require separate assessment. [2]

CVE-2026-109619: stale state reused between requests

This flaw involves internal data retained by a PHP worker after the memory behind it has been freed. A later request can encounter the leftover reference before initialization replaces it. This is a form of use-after-free. Confirmed paths include session upload progress and, in PHP 8.5, fatal-error backtrace state. Exposure depends on the runtime, configuration, and application behavior. [3]

The practical lesson is to patch the PHP runtime rather than relying solely on changes inside your website.

Which PHP versions contain the fixes?

The first patched upstream releases are: [18]

PHP branch	First fixed upstream release	Earlier unpatched releases in that branch
PHP 8.2	8.2.35	8.2.34 and earlier
PHP 8.3	8.3.36	8.3.35 and earlier
PHP 8.4	8.4.27	8.4.26 and earlier
PHP 8.5	8.5.12	8.5.11 and earlier

Install these releases or a later supported release containing the fixes. Vendor-maintained packages may use different version numbers.

Do PHP 7.4, 8.0, and 8.1 receive patches?

These branches no longer receive normal upstream releases. However, PHP's security team exceptionally provided minimal source backports for 7.4, 8.0, and 8.1 for these vulnerabilities. This does not restore their support lifecycle or guarantee that a hosting vendor has packaged the patches. [1]

As of this article's review date, supported stable branches are PHP 8.2–8.5. PHP 8.2 security support ends on December 31, 2026. Plan migrations accordingly. [4]

Why can an older-looking Linux package already be patched?

Distributions often backport security fixes into an existing package rather than replacing it with the newest upstream release. Red Hat explains that version-only checks can consequently report false positives. Check the complete package release and the vendor advisory. [5]

For example, Ubuntu's advisory lists 8.3.6-0ubuntu0.24.04.13 for Ubuntu 24.04 LTS as a fixed package version for these issues. A PHP version beginning with 8.3.6 therefore needs package-level verification; it cannot be judged solely against upstream 8.3.36. This example applies to Ubuntu's package, not to an arbitrary PHP build. [6]

For website owners: how to protect a site on shared hosting

If you use shared hosting, you usually cannot replace the server's PHP binaries yourself. Start with your hosting provider rather than copying administrator commands into a terminal.

1. Ask your provider to confirm both fixes

You can send this support request:

Please confirm whether the PHP runtime serving my domain has been patched against CVE-2026-109618 and CVE-2026-109619. Which PHP package version and vendor security advisory confirm the fixes? Have the affected PHP workers been restarted or replaced? Please also confirm whether any domain-specific PHP selection still uses an unpatched build.

A response saying only that “the server is updated” is less useful than confirmation tied to your domain and its actual PHP handler.

2. Check the PHP version assigned to your domain

Look for a PHP settings or version selector page in your hosting panel. A server may offer several PHP branches, and individual domains can use different ones.

Ask the host which patched option is compatible with your application. Before changing branches, take a backup and test important functions such as checkout, login, forms, and uploads. Moving to a different branch can introduce compatibility changes; a security update within the existing branch is a different operation.

3. Continue normal website maintenance

Keep your CMS, plugins, and themes current, maintain recoverable backups, and remove unused software. These remain useful security practices, but they do not establish that the PHP runtime has been fixed.

If the provider cannot patch promptly, ask about temporary access restrictions or migration to a patched service.

For administrators: inventory PHP before updating

Determine who supplies PHP on each server: the operating system, a third-party repository, a hosting panel, a source build, or a container image. One machine can contain several independent installations.

Start with:

php -v
php --ini
systemctl list-units --type=service --all 'php*'Copy

These are discovery steps, not proof that a website is protected. The default php command reports the CLI runtime, which may differ from the one serving web requests.

For Debian and Ubuntu package inventory:

dpkg-query -W -f='${binary:Package}\t${Version}\n' 'php*'Copy

For RPM-based systems, including panel package families:

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n' 'php*' 'ea-php*' 'alt-php*' 'plesk-php*'Copy

Also inspect domain-to-handler mappings and source installations outside the package database. Back up configuration and application data before making changes. Run only the update procedure that matches the installation you actually manage.

How to update PHP packages on Debian and Ubuntu

Refresh repository metadata and inspect the candidate package. This example uses PHP 8.3; substitute the branch already installed on your server:

sudo apt update
apt-cache policy php8.3-common php8.3-fpm php8.3-cliCopy

Confirm the candidate against the security advisory for your distribution and repository. Ubuntu publishes fixed package releases in USN-8948-1. Debian and third-party repositories have their own release tracking. [6]

For an existing PHP 8.3 FPM installation:

sudo apt-get install --only-upgrade php8.3-common php8.3-cli php8.3-fpmCopy

Include installed extensions and other PHP components in the reviewed update transaction. --only-upgrade prevents the named packages from being newly installed; it does not discover every PHP package for you. Review the proposed changes before accepting. [7]

After a successful update, validate and restart the matching FPM service:

sudo php-fpm8.3 -t
sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pagerCopy

If Apache uses mod_php, update the installed Apache PHP module instead and restart Apache after a configuration check:

sudo apt-get install --only-upgrade php8.3-common php8.3-cli libapache2-mod-php8.3
sudo apache2ctl configtest
sudo systemctl restart apache2Copy

These are alternative handler examples. Do not install an Apache PHP module on an FPM-only server merely to follow this guide. Match the binary paths and service names to your deployment.

How to update PHP on AlmaLinux, Rocky Linux, and RHEL

For a conventional distribution-managed PHP installation, refresh metadata and review available packages:

sudo dnf makecache --refresh
sudo dnf list --installed 'php*'
sudo dnf list --showduplicates php-commonCopy

Then update the installed PHP package family:

sudo dnf upgrade --refresh 'php*'Copy

Review the transaction and verify its package releases against the supplier's advisory. An update command succeeding does not prove the repository already contains the fixes.

For a standard FPM deployment:

sudo php-fpm -t
sudo systemctl restart php-fpm
sudo systemctl status php-fpm --no-pagerCopy

For Apache mod_php, validate Apache's configuration and restart httpd instead. Vendor software collections can have different service names and binary locations. Do not change PHP module streams or switch repositories as an incidental part of this security update.

Updating PHP through hosting control panels

Panel-managed PHP may live outside the operating system's default PHP package family. cPanel, for example, uses separate ea- package namespaces. [8]

Platform	Administrator update route	Important verification
cPanel/WHM	Review EasyApache 4 packages and apply the supplier's security updates.	Check every installed PHP branch and each domain's assigned handler.
DirectAdmin	Use CustomBuild for PHP builds managed by CustomBuild.	Check configured branches, build output, and active workers.
Plesk	Follow Plesk's security notice and update procedure.	Check Plesk PHP handlers and any separately affected panel components.
CloudLinux PHP Selector	Apply the relevant vendor updates for installed Alt-PHP branches.	Confirm the domain's selected runtime and the vendor's fixed package releases.

On RPM-based cPanel systems, an example package-family update is:

sudo dnf upgrade --refresh 'ea-php*'Copy

Follow cPanel's service-management procedure afterward; restarting the distribution's default php-fpm service alone may leave panel-managed workers running. [8]

For DirectAdmin CustomBuild, run as an administrator after reviewing the configured branches and any version overrides:

sudo da build update
sudo da build versions
sudo da build phpCopy

CustomBuild compiles and manages PHP independently of a normal OS package update. Check that its available versions contain the fixes before building. [9][10]

For Plesk, use its vendor notice to check release availability for your operating system. Its bundled website PHP handlers and the panel's own sw-engine require separate attention. Do not assume updating /usr/bin/php updates them. [11]

For CloudLinux Alt-PHP, the vendor documents the package-family update below. Run it only on a system that actually uses those packages, and confirm patched builds are available first: [12]

sudo yum update 'alt-php*'Copy

Updating PHP in Docker containers

Updating PHP on the host does not update a container image. Select a verified patched image tag or digest in your deployment configuration.

For an image-based Compose deployment whose PHP service is named php:

docker compose pull php
docker compose up -d --no-deps --force-recreate php
docker compose exec php php -vCopy

Replace php with your actual service name. Pulling downloads the image; recreating replaces the running container. Restarting an existing container alone does not replace its image. [13][14]

For a custom image, rebuild against a patched base image, test it, and redeploy. Confirm that required application data resides in persistent storage before replacing containers.

Temporary manual mitigations when you cannot patch immediately

Configuration changes are temporary risk reductions. They do not fix both vulnerabilities completely. Restrict public access to the affected origin if you cannot make a prompt, verified update.

Reduce known session and backtrace paths

PHP recommends the following startup-level setting for the confirmed session-related paths: [3]

session.upload_progress.enabled = 0Copy

For PHP 8.5 only, also disable fatal-error backtraces while awaiting the patch:

fatal_error_backtraces = 0Copy

Apply these administratively before request parsing and restart all affected workers. Do not rely on application ini_set() calls or .user.ini for this mitigation. Other stale-state paths remain possible. [1][3]

Treat the OOM workaround as an administrator-only decision

PHP identifies administratively enforced memory_limit = -1 as a partial mitigation for the controllable PHP-limit OOM path. This removes PHP's per-request memory cap, creating a serious resource-exhaustion trade-off. Allocation failures remain possible. Do not apply it casually across shared hosting. [2]

Only if an administrator has assessed capacity and isolation, an FPM pool example is:

php_admin_value[memory_limit] = -1Copy

FPM administrative values prevent application overrides through ini_set(). Verify every pool and effective web configuration. [15]

Keep request bodies and uploads conservative and enforce limits at the frontend. Container or cgroup memory boundaries are not a complete mitigation; PHP specifically warns against substituting RLIMIT_AS or RLIMIT_DATA because allocation failures can reach the vulnerable path. [2]

Review upload requirements before choosing limits. For illustration, an application that accepts small uploads might use:

post_max_size = 8M
upload_max_filesize = 2MCopy

These sizes are application choices, not a universal security fix. PHP documents that post_max_size must exceed the upload limit. Test legitimate forms and uploads after changing either value. [16]

After installing the complete fix, restore an appropriate finite PHP memory limit and remove temporary overrides that are no longer needed. Validate the effective settings and restart the affected workers again.

What about WAF and ModSecurity rules?

A web application firewall can help block known request patterns while patching proceeds. Coverage depends on the ruleset, enforcement mode, web server, and whether attackers can reach the origin directly.

CloudLinux's October 21 notice illustrates the difference: Imunify360 ruleset 8.83 blocked a known exploit pattern on Apache, but the corresponding LiteSpeed handling logged rather than blocked it. This was interim coverage, not a complete fix. Check the vendor's current notice before relying on any specific ruleset behavior. [12]

Applying the fixes manually to a source build

If you compile PHP yourself, prefer building a complete patched release using your established build configuration and deployment process. Preserve required extensions, configuration locations, service integration, and application compatibility.

For an EOL branch, start from the source backports linked in PHP's official advisory. Have the build maintainer verify the patch set, rebuild the runtime, test it, deploy it, and replace existing workers. Avoid applying an arbitrary commit or copying binaries from an unrelated installation.

A source patch sitting in a checkout changes nothing for a production process that still runs the old binary.

How to verify that your website is protected

Use three kinds of evidence:

1. Package evidence: the complete installed package release matches a vendor advisory fixing both CVEs, or the source build comes from a patched release.
2. Runtime evidence: the domain uses that build, and old PHP workers have been replaced.
3. Application checks: login, forms, uploads, scheduled tasks, and checkout still work after deployment.

Remember that PHP can load different configuration files for different SAPIs, and server processes read configuration at startup. php --ini describes the CLI invocation, not necessarily the website's configuration. [17]

Use authenticated panel diagnostics or a short-lived access-restricted diagnostic endpoint to inspect the web runtime. Remove temporary diagnostic files afterward. A public phpinfo() page is unnecessary for routine confirmation.

Do not use a public exploit against production as your update test. Also, the absence of errors or suspicious requests in logs does not establish that an unpatched installation is safe.

Troubleshooting common update problems

The package manager says there is nothing to update

Check the package supplier, repository metadata, security repositories, version locks, and installed branch. The runtime may be managed by a panel, source build, or container rather than the OS package manager. Ask the supplier for the fixed package identifier instead of assuming “no updates” means “not vulnerable.”

The terminal shows a patched version, but the panel shows an older one

Check which binary serves the domain. A CLI update may not affect its FPM pool, LSAPI handler, or panel-managed PHP installation. Verify the domain mapping and the corresponding running workers.

The site fails after updating

Inspect service and application logs, configuration syntax, and extension compatibility. Restore service using a verified patched build or isolate the affected site during recovery. An unpatched rollback should not become the permanent solution.

You suspect the site was already compromised

Updating PHP does not remove an existing intrusion. Restrict access, preserve logs and evidence, and involve the hosting provider or incident-response team. Investigate unexpected files, accounts, scheduled tasks, and outbound connections. Rotate exposed credentials from a trusted environment as part of recovery.

Frequently asked questions

Does updating WordPress fix CVE-2026-109618 and CVE-2026-109619?

No. These are PHP runtime vulnerabilities. Keep WordPress current, but obtain separate confirmation that the server's PHP build contains the fixes.

Is PHP 8.3 automatically safe?

No. The branch alone is insufficient. Check the patch release or the full vendor package identifier against the relevant advisory.

Do shared hosting customers need SSH access?

Usually not. Your provider should handle runtime patching. Ask it to confirm protection for your domain and advise you about any required PHP selection changes.

Is disabling session upload progress enough?

No. It addresses specific paths. It does not replace the complete security update.

Does HTTPS protect against these vulnerabilities?

HTTPS encrypts traffic in transit. It does not establish that the PHP process receiving that traffic has been patched.

Should I move every site to PHP 8.5 immediately?

Not necessarily. Prioritize a verified security fix for the runtime you use, then plan broader migrations with compatibility testing. An upstream-EOL application needs a supported migration plan or explicitly confirmed vendor coverage.

Does restarting Nginx complete the PHP update?

Not when PHP runs in separate workers or containers. Replace or restart the PHP processes that actually execute the site, following the deployment's service procedure.