Critical PHP remote code execution flaws: update now
Two critical PHP vulnerabilities can allow unauthenticated remote code execution on web-facing servers. Supported PHP branches have patched releases available.
Who is affected
- PHP 8.2 before 8.2.35
- PHP 8.3 before 8.3.36
- PHP 8.4 before 8.4.27
- PHP 8.5 before 8.5.12
- Older, unsupported PHP branches unless your operating-system vendor has supplied a verified backport
- Web-serving PHP installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed
Is it being exploited?
No active exploitation was confirmed in the PHP, NVD or CISA sources reviewed on October 25, 2026. That does not mean exploitation is impossible; treat the critical severity and vendor update guidance as the priority.
What to do now
- 1
Inventory every internet-facing PHP service and record its PHP version and server API (SAPI).
- 2
Update to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a later supported release. If PHP comes from an operating-system vendor, confirm that the vendor package includes both CVE fixes.
- 3
Restart every PHP worker and web-server process after updating so no vulnerable process remains in memory.
- 4
Confirm the running version from the server itself, then test websites, uploads, sessions and background jobs.
- 5
If an immediate update is impossible, apply only the temporary measures in PHP’s official advisory and schedule the full update as an emergency change.
What happened
PHP published security releases for two memory-safety vulnerabilities that can lead to unauthenticated remote code execution. PHP rates both issues critical and recommends that all users update immediately.
CVE-2026-109618 involves out-of-memory handling interrupting a request while internal data is only partly initialized. Cleanup can then treat invalid data as valid. CVE-2026-109619 involves request-owned global state surviving after its backing memory has been freed, allowing a later request handled by the same worker to encounter stale state.
Why this matters to small businesses
PHP runs many public websites, customer portals and business applications. A successful attack against a vulnerable, reachable service could expose website data, credentials or the underlying server and may become a route into other systems.
Updating is the complete fix. PHP states that temporary mitigations only reduce specific confirmed attack paths and do not make a vulnerable installation safe.
How we can help
We can help you confirm exposure, plan the change and validate the environment after remediation.
Official sources
This advisory is provided for general guidance. Always follow your vendor's official advisory.