Last Updated: 22 October 2026

 

A critical security issue has been identified in the PHP runtime, affecting websites and applications running vulnerable PHP versions. On 21 October 2026, the PHP development team released security updates to address two vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow attackers to execute malicious code remotely without authentication. They may also expose sensitive information through memory-related issues. Both vulnerabilities have a critical severity rating, with a CVSS score of 9.2. Successful exploitation could put websites, applications, and the underlying server environment at risk. VPS owners, web hosting providers, and server administrators should review their PHP installations and apply the appropriate security updates immediately.

 

Understanding the PHP Vulnerabilities

The vulnerabilities involve how PHP handles memory and internal application request data.

 

CVE-2026-109618 – Out-of-Memory Corruption

This vulnerability occurs when PHP encounters an out-of-memory (OOM) condition while internal request data is only partially initialized. During request cleanup, PHP may incorrectly process this incomplete data, potentially resulting in memory corruption. Under certain conditions, an attacker could exploit this behavior to execute malicious code remotely.

 

CVE-2026-109619 – Stale Internal State

This vulnerability relates to internal request data that remains accessible after the memory supporting it has been released. A later request handled by the same PHP worker may access this outdated state before it has been properly initialized. This could create an opportunity for remote code execution. Both vulnerabilities affect the security of the PHP runtime itself, rather than being limited to a particular website, plugin, or content management system.

 

Which Systems May Be Affected?

Any server running a vulnerable PHP installation that handles web requests may be at risk. Potentially affected environments include:

  • PHP websites built with WordPress and other content management systems.
  • Applications developed using frameworks such as Laravel.
  • Custom PHP applications and web services.
  • VPS and dedicated servers running PHP.
  • Servers using PHP-FPM, Apache with mod_php, CGI-based PHP, FrankenPHP, or LiteSpeed.
  • Custom container images and deployments that include vulnerable PHP packages.

The actual exposure depends on the PHP version, package build, server configuration, and available security patches. However, administrators should not assume that a system is safe simply because it uses a particular hosting platform or application. The PHP development team has identified Apache mod_php as a particularly high-risk configuration, with a demonstrated exploit that can trigger the issue before application code runs.

 

Affected PHP Versions and Available Security Fixes

The PHP development team has released fixes for the following PHP branches.

PHP Branch Vulnerable Versions  Fixed Version
PHP 8.5 8.5.11 and earlier 8.5.12
PHP 8.4 8.4.26 and earlier 8.4.27
PHP 8.3 8.3.35 and earlier 8.3.36
PHP 8.2 8.2.34 and earlier 8.2.35

 

These releases address CVE-2026-109618 and CVE-2026-109619.

 

Important: PHP 8.1 and older versions no longer receive security fixes directly from the PHP project. Certain operating system vendors and extended-support providers may provide backported fixes for older versions. The availability of these patches depends on the vendor and package build.

 

Administrators running older PHP versions should verify their package status with the relevant vendor and plan to upgrade to a supported PHP branch wherever possible. The version number alone may not be sufficient to determine whether an older vendor-maintained package is protected. For the complete technical advisory, visit the official PHP security announcement.

 

Recommended Security Actions for VPS Owners

VPS administrators should take the following steps to identify vulnerable systems and reduce security risks.

 

1. Audit All PHP Installations

Identify every PHP installation running on your VPS infrastructure, giving priority to systems accessible from the internet. Check the PHP versions used by individual websites, subdomains, command-line applications, background workers, and containers. A single server may have multiple PHP versions installed. Do not limit the audit to the PHP version selected for your main website.

 

2. Install the Appropriate Security Updates

Upgrade vulnerable PHP installations to the relevant fixed release or apply an official vendor-provided security patch. For self-managed VPS environments, check the operating system repositories and the package sources used to install PHP. If PHP is managed through a hosting control panel, follow the panel vendor's security instructions. After updating, restart or redeploy the relevant PHP services when required to ensure that the patched runtime is being used.

 

Changing the PHP version in a website's control panel does not necessarily update every PHP installation on the server. Verify the actual runtime and package build used by each application.

 

3. Update Your Hosting Control Panel

If your VPS uses cPanel & WHM or Plesk, check for the applicable security updates for both the PHP packages and the control panel components. Control panels may distribute PHP through their own package systems. A general operating system update may not update every panel-managed PHP version. Use the official cPanel or Plesk instructions provided in the More Information section below.

 

4. Review Unsupported PHP Versions

Older PHP branches may no longer receive security updates from the PHP project. Where possible, upgrade applications using unsupported versions to a maintained PHP branch. Before upgrading production websites, check compatibility with your application's code, themes, plugins, and dependencies. If an older version is essential, confirm that your software vendor provides an applicable security fix and verify that it has been installed.

 

5. Monitor Your VPS for Suspicious Activity

Security patching should be accompanied by appropriate monitoring. Review web server logs, PHP logs, authentication records, and other relevant security events for unusual activity. Pay particular attention to unexpected processes, suspicious requests, unauthorized file changes, or signs of persistent access. If you suspect that a server has been compromised, investigate the incident rather than assuming that installing a patch alone removes any malicious changes.

 

6. Maintain Backups and Test Your Applications

Maintain recent backups of important website files, databases, and server configurations. After applying security updates, test your websites and applications to confirm that essential features are operating normally. Continue monitoring the server for errors or unexpected behavior. Backups are an important recovery measure, but they do not replace security updates.

 

Security Updates for cPanel & WHM

cPanel has published patched versions of cPanel & WHM and its EasyApache 4 PHP packages. Server administrators should update their installations to the patched builds applicable to their cPanel release and installed PHP branches. The cPanel advisory includes specific package versions for several PHP branches, including vendor-maintained older versions. Because the required build varies by package and environment, consult the official advisory before applying changes. 

Read the latest instructions here:  cPanel – Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619

 

Security Updates for Plesk

Plesk has also published security guidance covering the affected PHP packages and its own control-panel components. For Plesk Obsidian, the current advisory lists PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as fixed releases. Older PHP branches may require particular package builds, even when the displayed PHP version number remains unchanged.

 

The Plesk control-panel component also has specific patched update levels. Administrators should therefore check and update both their PHP packages and the relevant Plesk components. The exact steps depend on whether the server runs Plesk for Linux or Windows and which PHP versions are installed.

 

Read the latest instructions here:  Plesk – CVE-2026-109618 and CVE-2026-109619: Remote Code Execution in PHP Shipped with Plesk

 

What If You Cannot Apply the Update Immediately?

Applying the appropriate security update is the recommended solution. If an immediate update is not possible, review the temporary mitigation guidance published by the PHP development team and follow the recommendations applicable to your environment. Temporary measures should not be treated as a permanent replacement for patching. If you cannot update or apply suitable mitigation promptly, assess whether the exposed service should be taken offline until it can be secured. Where compromise is suspected, investigate the system for unauthorised access and potential persistence, with assistance from a qualified security professional when necessary. Refer to the official PHP advisory and the UK National Cyber Security Centre guidance for further recommendations.

 

Final Recommendations

CVE-2026-109618 and CVE-2026-109619 represent a serious security concern for PHP-based websites and server infrastructure. Exploitation may allow unauthenticated remote code execution, making timely remediation essential. VPS owners and administrators should:

  • Identify all PHP installations across their infrastructure.
  • Apply the appropriate PHP and vendor security updates.
  • Verify that hosting control panel components are also updated.
  • Monitor systems for suspicious activity.
  • Plan upgrades for unsupported PHP versions.
  • Maintain reliable backups and verify application functionality after patching.

Keeping your server software up to date is an essential part of maintaining a secure VPS environment. Review the official vendor advisories regularly and ensure that your systems remain protected as further guidance becomes available.

 

More Information

For official technical details and security remediation instructions, consult the following resources: