What happened?
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Its advisory says the flaws can allow unauthenticated remote code execution. The risk applies to PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
The project describes CVE-2026-109618 as an out-of-memory handling issue involving partially initialized request data. CVE-2026-109619 concerns request-owned internal state that can survive after backing memory is freed. These are runtime issues, so an application can be exposed even when its own code has been carefully reviewed.
Which versions contain the fixes?
The PHP project lists 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the fixed releases for their respective branches. Check the PHP version actually used by the web server or container, not only the version installed for command-line scripts. PHP 8.2 reaches end of life on 31 December 2026, so teams on that branch should also schedule a supported-version upgrade.
A practical response plan
Inventory every production and staging PHP runtime, including containers, managed hosting and older microsites. Back up the application, database and configuration; update the runtime to the fixed release for its branch; then restart affected workers so they load the new binary.
After deployment, confirm the active web runtime version, run your essential user journeys and inspect error logs. Review exposed services and access logs for unusual requests, and follow your incident process if you find signs of compromise. Update dependencies and application code separately; they do not replace the PHP runtime fix.
What to tell stakeholders
Keep the message precise: which environments were affected, which version each now runs, when the change went live, and what verification was performed. Avoid claiming that a firewall rule or a configuration change fully resolves these CVEs. The PHP project says updating is the only safe choice.
