Critical PHP Security Patch Release: CVE-2026-109618 and CVE-2026-109619
Oct 22, 2026
Last Updated: 22 October 2026
The PHP development team released critical security updates on 21 October 2026 to address two serious vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities could allow an unauthenticated attacker to execute malicious code on a vulnerable server. They may also expose sensitive information from PHP process memory. Both vulnerabilities have a critical severity rating, with a CVSS v4.0 score of 9.2.
Since PHP powers many websites, content management systems, and web applications, including WordPress, these vulnerabilities may affect a wide range of hosting environments. Website owners and server administrators are strongly advised to check their PHP installations and apply the appropriate security updates as soon as possible.
What Are These Vulnerabilities?
The two vulnerabilities affect the internal operation of the PHP runtime.
- CVE-2026-109618: Out-of-Memory (OOM) Corruption
This vulnerability is related to how PHP handles an out-of-memory condition. Under certain circumstances, PHP may attempt to process internal request data that has not been fully initialized. An attacker may exploit this condition to cause memory corruption and potentially execute malicious code on the affected server.
- CVE-2026-109619: Stale Global State
This vulnerability involves internal PHP state that may remain available after its associated memory has been released. A subsequent request handled by the same worker may use this stale state before it has been properly reset, potentially allowing an attacker to execute malicious code. Both vulnerabilities are considered critical because successful exploitation may compromise the security of a PHP-based application or its hosting environment.
Who Is Affected?
Any website or application running a vulnerable PHP installation may be affected.
This includes:
- WordPress websites and other content management systems.
- PHP-based applications and custom-developed websites.
- Applications using frameworks such as Laravel.
- Websites running on shared hosting, VPS, or dedicated servers.
- PHP applications deployed in containers or other hosting environments.
The vulnerabilities are not specific to a particular hosting provider or content management system. They affect the underlying PHP runtime. The official PHP advisory identifies PHP installations serving web requests as being at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed environments.
Affected PHP Versions and Fixed Releases
The PHP development team has released the following security updates for supported PHP branches.
| PHP Branch | Affected Versions | Fixed Version |
| PHP 8.5 | Versions below 8.5.12 | 8.5.12 |
| PHP 8.4 | Versions below 8.4.27 | 8.4.27 |
| PHP 8.3 | Versions below 8.3.36 | 8.3.36 |
| PHP 8.2 | Versions below 8.2.35 | 8.2.35 |
These fixed releases address both CVE-2026-109618 and CVE-2026-109619.
Important: PHP 8.1 and older versions no longer receive security updates directly from the PHP project. However, some operating system vendors, hosting platforms, and extended-support providers may release their own security patches for older PHP branches.For this reason, the PHP version number alone may not always confirm whether an installation is protected. Check the relevant vendor's security advisory and package or build information. For the official release details, refer to the PHP security advisory.
What Should Website Owners Do?
To reduce the risk associated with these vulnerabilities, website owners should take the following steps.
1. Check Your Website's PHP Version
Identify the PHP version used by each website, subdomain, and application. If you host multiple websites or use different PHP versions for different applications, check each one individually.
2. Apply the Latest Security Updates
Update affected PHP installations to the appropriate fixed release. If you manage your own server, ensure that the relevant PHP packages and hosting control panel components are updated. If your hosting provider manages the server, contact its support team to confirm that the required security patches have been applied. Simply changing the PHP version selected for a website does not guarantee that the underlying server packages have been patched.
3. Review Older PHP Versions
If your website uses PHP 8.1 or an older branch, plan to migrate to a supported PHP version. Before upgrading, check that your website, themes, plugins, and applications are compatible with the target PHP version. If an older version is required for compatibility, confirm whether a supported vendor-provided security patch is available.
4. Back Up Your Website
Create a recent backup of your website files and databases before making significant PHP or server changes. After applying updates, test the website to verify that its important features continue to work correctly.
5. Keep Your Website Software Updated
Keep your content management system, themes, plugins, frameworks, and other application components updated. Regular maintenance helps reduce security risks and supports the overall reliability of your website.
6. Do Not Rely on Temporary Mitigations Alone
Configuration changes or other temporary security measures may help reduce exposure in specific environments. However, they should not be considered a replacement for applying the appropriate security updates. The PHP development team recommends updating to a fixed release as the primary solution.
Additional Information for cPanel and Plesk Users
The required updates depend on the control panel, operating system, PHP packages, and hosting environment installed on the server.
cPanel and WHM
cPanel has published security updates for cPanel & WHM and its EasyApache 4 PHP packages. Server administrators should update the relevant components and verify that the installed PHP packages include the required fixes. Patch availability may differ for older PHP branches and vendor-specific packages. Administrators should follow the official cPanel guidance for the appropriate environment.
Plesk
Plesk has published guidance covering the affected PHP packages and the PHP component used by the Plesk control panel itself. Administrators should update Plesk and its relevant PHP packages to the vendor-patched builds. Older PHP versions may require special attention because some fixes use updated package build dates rather than a new PHP version number. Refer to the official Plesk advisory for the latest package versions and platform-specific instructions.
How Can You Confirm Your Website Is Protected?
To confirm that the vulnerability has been addressed:
- Identify the PHP runtime used by your website.
- Check the installed PHP package or build against the applicable vendor security advisory.
- Confirm that the relevant PHP runtime and control panel components have been updated.
- Test your website after the update and monitor it for unusual behaviour.
For websites on shared hosting, the hosting provider generally manages system-level PHP packages. Contact your provider if you are unable to verify whether the required updates have been applied. If you manage a VPS or dedicated server, ensure that all relevant PHP installations are patched, including those used by separate websites, applications, or containers.
Conclusion
CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that may allow unauthenticated remote code execution on affected systems. The PHP development team has released security updates for PHP 8.2, 8.3, 8.4, and 8.5. Website owners and server administrators should review their environments, apply the appropriate security patches, and verify that the updates are effective.
Keeping PHP, hosting control panels, and website applications up to date is an important part of maintaining a secure and reliable hosting environment. If you are unsure whether your website is affected or whether the required updates have been applied, contact your hosting provider for assistance.
More Information
For detailed technical information and platform-specific remediation instructions, refer to the following official resources:
- cPanel: Critical PHP Security Release – CVE-2026-109618 and CVE-2026-109619
- Plesk: Vulnerability CVE-2026-109618 and CVE-2026-109619 – Remote Code Execution in PHP Shipped with Plesk
- PHP Official Advisory: Critical Remote Code Execution Vulnerabilities – Update Now
