Two Critical PHP Vulnerabilities Discovered: Immediate Security Update Required

Two Critical PHP Vulnerabilities Discovered: Immediate Security Update Required

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Active exploitation has been reported.

As we have no access to your VPS, VDS or dedicated server, we cannot apply the update for you. We therefore ask you to install it immediately as soon as patched packages are available for your system.

The vulnerabilities

CVE-2026-109618: remote code execution via out-of-memory corruption
CVE-2026-109619: remote code execution via stale global state

Both are rated 9.2 (critical) on the CVSS v4.0 scale. All PHP installations serving web requests are at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). Risk is highest for mod_php. Full details are in the official PHP security advisory.

Fixed PHP versions available

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35 (end of life on 31 December 2026, so please plan an upgrade)

PHP 8.1 and older no longer receive updates from the PHP project. If you run one of these versions, please upgrade to a supported version or check for backported fixes. Minimal source-code backports for PHP 7.4, 8.0 and 8.1 exist, but only for building from source.

What you should do

Create a snapshot or backup before updating.
Update PHP via your distribution’s package manager or your control panel as soon as the patched version is available.
Restart PHP-FPM, Apache or your web server so that all workers load the new version. Without a restart, the old code keeps running.
Verify the version actually in use, for example with php -v and with a phpinfo page for your web server. Check every PHP version installed on the server.
If you cannot update immediately, apply the interim measures from the official PHP security advisory. They only reduce exposure and do not make the installation safe. Updating is the only complete fix.

Where to find patches for your panel

cPanel/WHM and EasyApache 4: updates for EasyApache 4 are already available. Please run the cPanel update (via WHM or /scripts/upcp) now, then restart PHP-FPM/Apache and verify the PHP versions in use. Release notes and announcements are at docs.cpanel.net.
Plesk: Updates for Plesk Obsidian are already available, please update via Plesk panel.
CloudLinux (Alt-PHP): follow the CloudLinux status page and the CloudLinux blog. CloudLinux also offers extended support for PHP versions that are no longer maintained.
Linux distributions: check the security advisories of your distribution (Debian, Ubuntu, AlmaLinux, Rocky Linux, RHEL and others).
Third-party repositories: the volunteer-maintained rpms.remirepo.net does not provide updates on the release day. The PHP project recommends switching to distribution packages or building from source.

Best practices

Enable automatic security updates where possible, and check your panel’s update settings.
Remove PHP versions and applications you no longer use.
Keep CMS, plugins and themes up to date.
Use a web application firewall and limit access to administrative interfaces.
Check for signs of compromise: unknown files in web directories, new cron jobs, unusual processes or spikes in load and outgoing traffic.