• Wednesday, October 21, 2026

# Security notice: critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

**Published: 21 October 2026**

## What happened

The PHP project has released fixes for two critical vulnerabilities, both rated
CVSS 9.2. They may allow remote code execution without authentication against
web servers running PHP.

- **CVE-2026-109618** — remote code execution via out-of-memory corruption
- **CVE-2026-109619** — remote code execution via stale global state

Fixed versions are **8.2.35**, **8.3.36**, **8.4.27** and **8.5.12**. Branch 8.1
received no upstream release; some vendors have backported the fix, so check
your vendor's package changelog rather than the version number alone.

## What we have already done

Patching has been completed across our managed hosting platform. Where a fixed
build was not yet published by the upstream vendor, we applied the interim
hardening recommended in the official advisories and restarted all workers.

We reviewed our logs for the failure patterns these flaws produce and found
none. No customer action is required for this, and no service interruption was
involved.

## What you need to do

**If you use our shared or managed hosting:** nothing for PHP itself — it has
been updated for you. We still recommend keeping your applications, plugins and
themes current, since outdated application code remains the most common way
sites are compromised.

**If you run a VPS, a dedicated server, or any server you administer yourself:**
PHP on your server is yours to update, and you should do it now.

1. Check your version: `php -v`, and also check each version you serve sites
   with, since many servers run more than one.
2. Update to **8.2.35 / 8.3.36 / 8.4.27 / 8.5.12** or later, using your
   distribution's package manager or your control panel's update tool.
3. **Restart your web workers afterwards.** Updating the package is not enough —
   running processes keep the old code until they are restarted.
4. Confirm the new version is the one actually serving requests, not just the
   one on the command line. These are often different builds with different
   configuration.

### If you cannot update immediately

The advisories list interim measures. They reduce risk but do not replace the
update:
session.upload_progress.enabled = 0
fatal_error_backtraces = 0


Apply them to the configuration your web server uses, then restart your
workers. Lowering `post_max_size` and limiting upload and request sizes at your
web server also reduces exposure.

### A note on older PHP

If you run PHP 8.1 or earlier, upstream PHP no longer publishes releases for
those branches. Some distributions and control panels backport security fixes;
confirm with your vendor. If yours does not, treat an upgrade to a supported
branch as urgent.

## Sources

- CERT-EU advisory 2026-018
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

If you need help identifying which PHP versions your server runs, open a ticket
from your client area and we will walk you through it.

Back