Two critical PHP vulnerabilities require immediate patching
On 21 October 2026, the PHP security team released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. The team rates each CVSS v4.0 9.2 and urges PHP users to update immediately.
CVE-2026-109618 concerns out-of-memory handling that can interrupt PHP while request data is only partially initialized. CVE-2026-109619 concerns request-owned global state that can outlive its backing memory. The PHP advisory says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger a demonstrated exploit before application code runs.
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, as appropriate for your supported branch. If PHP comes from a Linux distribution or long-term support vendor, check that vendor's patched package. PHP 8.1 and older no longer receive security updates from the PHP project; some vendors provide backported fixes, so verify the exact package rather than relying on the version number alone.
There is no complete workaround. The PHP team lists temporary measures that can reduce exposure to specific attack paths, but says updating is the only safe choice. Inventory the PHP runtime behind each public application, apply the relevant update, restart affected workers where required and confirm the running version. Updating WordPress, Drupal or other application code alone does not update the PHP runtime beneath it.
Read the full PHP security advisory and its linked technical advisories for affected configurations and interim measures. If you need help assessing PHP exposure or planning the update, contact ITIFY.