Vulnerability

PHP announces security update for two critical vulnerabilities

On 21 October 2026, the PHP security team released security updates for two critical vulnerabilities in PHP. These vulnerabilities allow for remote code execution without authentication. PHP urges all users to update immediately.

Clip path group@2x

T-Update

Information about vulnerabilities

This live blog contains information regarding two critical vulnerabilities in PHP.
‍
Update 21 October 2026 16:00

The PHP security team has published the announced security updates. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have a CVSS v4.0 score of 9.2. PHP confirms that an unauthenticated remote attacker can execute code.

According to PHP, all installations that process web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk to be highest with mod_php, where an attack can begin before application code is executed.

Update affected installations immediately. Do you use PHP via a hosting provider or vendor? If so, check whether they have implemented the security updates. According to PHP, temporary measures do not offer complete protection. Keep websites and web applications that have been taken offline as a precaution shielded until the necessary security updates have been applied.

‍

Update 21 October 2026 13:30

Tesorion advises that, as a precaution, publicly accessible websites and web applications using PHP should be taken offline as soon as possible until it is clear whether they are vulnerable and the necessary security updates have been applied.

Work with your hosting provider or administrator to identify which websites and applications use PHP. Prepare for the installation of security updates so that they can be applied immediately upon release. The release is scheduled for today at 16:00 Dutch time.

Tesorion Immunity does not use PHP. These vulnerabilities are therefore not applicable to Immunity. 

As a precaution, Tesorion has also temporarily taken the customer portal offline. Consequently, the portal is currently unavailable.
‍

Update 21 October 2026 12:00

On 20 October 2026, the PHP security team announced a security update for two critical vulnerabilities in PHP. The release is scheduled for Wednesday, 21 October 2026, at 14:00 UTC. Following this announcement and leaked information, CERT-EU has published an advisory. PHP is widely used for web applications, including WordPress, Drupal, and Magento.

The American company Cloudflare, which acts as a firewall for many popular websites, is now seeing the first attacks. Cloudflare’s firewall is blocking attempts to exploit the vulnerability, the company stated via ‘X’.

‍

‍

Customized cyber security

Background

CVE-2026-109618 and CVE-2026-109619 both have a CVSS v4.0 score of 9.2. CVE-2026-109618 relates to the handling of out-of-memory errors, which can leave request memory in an invalid state. CVE-2026-109619 concerns data retained by a worker from a previous request, even though the associated memory has already been released. All PHP installations that process web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Versions lower than 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are affected. These four versions contain the fix. PHP 8.1 and older no longer receive updates from the PHP project. However, the security team has made minimal source backports available for PHP 7.4, 8.0, and 8.1. PHP 8.2 will no longer receive security updates after 31 December 2026.

Risk

HP rates both vulnerabilities as critical, with a CVSS v4.0 score of 9.2. An attacker can execute code without authentication, using the privileges of the account under which the web worker is running. PHP considers the risk to be highest with mod_php, where a request can trigger the attack before any application code runs. Full remote code execution has been demonstrated against mod_php, and for CVE-2026-109619, against FPM as well. PHP makes no mention of active exploitation in this release.

‍

‍

Advice

  • Update PHP immediately to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. According to PHP, updating is the only secure option.
  • Are you using PHP packages from a Linux distribution or LTS provider? If so, check with that provider to see if updated packages are available. They have received the patches in advance.
  • Are you using the rpms.remirepo.net repository? PHP advises switching to distribution packages or compiling from source, as this repository does not have updates today.
  • Are you running PHP 8.1 or older? Ask your provider about backports or switch to a supported version. For PHP 7.4, 8.0 and 8.1, source backports are available if you compile them yourself.
  • Are you running PHP 8.2? Plan your migration to a newer version, as 8.2 will no longer receive security updates after 31 December 2026.


Unable to update immediately? Take temporary measures. According to PHP, these reduce exposure but do not make an installation secure.

  • To mitigate CVE-2026-109618: set memory_limit=-1, preferably via php_admin_value, and keep post_max_size low (8M without uploads, 32M with uploads). Keep upload_max_filesize below post_max_size.
  • To mitigate CVE-2026-109619: set session.upload_progress.enabled=0 and restart all workers. On PHP 8.5, also set fatal_error_backtraces=0.

Do you have questions about the potential impact on your environment, or do you require support? Please contactT-CERT.

Sources

Ellipse 6

Sign up to receive T-Updates

Receive the latest vulnerabilities in your email every Wednesday

More than 1,000 organisations have already joined us.

Tesorion gebruikt jouw gegevens voor het versturen van de gevraagde informatie. Daarnaast worden je gegevens mogelijk gebruikt voor commerciële opvolging. Je kunt je op elk gewenst moment hiervoor afmelden via de link in de e-mail. Lees voor meer informatie ons privacybeleid.

Ellipse 6