Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619 — Update Your PHP Servers Immediately

PHP developers, website owners, and server administrators should take immediate action following the disclosure of two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have a CVSS v4.0 severity score of 9.2 and can potentially allow unauthenticated attackers to execute arbitrary code on affected servers.

The PHP development team released security updates on October 21, 2026. Security agencies have urged organisations to patch affected systems as soon as possible, particularly those exposed to the public internet.

For businesses running PHP websites, APIs, content management systems, and web applications, this is an important reminder that application security depends on keeping the underlying runtime up to date.

What Are CVE-2026-109618 and CVE-2026-109619?

These vulnerabilities, discussed collectively under the name PHP2Shell, affect the PHP runtime's internal memory handling and request-processing mechanisms.

Unlike vulnerabilities limited to a particular plugin or application framework, these issues affect PHP itself. Consequently, potentially vulnerable deployments include PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP, and LiteSpeed configurations.

1. CVE-2026-109618: Remote Code Execution Through Memory Corruption

This vulnerability involves improper handling of memory when PHP encounters an out-of-memory condition.

PHP enforces memory limits to help prevent applications from consuming excessive resources. Under certain conditions, an error can interrupt request processing while internal data structures are only partially initialised.

Subsequent cleanup operations may then process invalid memory, potentially creating an opportunity for an attacker to execute code.

Potential impact:

• Unauthorised execution of code on an affected server.
• Compromise of the PHP application or its runtime environment.
• Potential access to application data and credentials, depending on server permissions.
• Service disruption or further compromise of the hosting environment.

2. CVE-2026-109619: Remote Code Execution Through Stale Internal State

The second vulnerability concerns internal PHP state that may remain available after the memory associated with a request has been released.

If a subsequent request handled by the same worker uses this stale state before it has been properly reinitialised, the resulting memory corruption may allow an attacker to execute code.

Potential impact:

• Potential unauthorised code execution through vulnerable request-processing paths.
• Exposure of sensitive application information.
• Possible compromise of other applications or data accessible to the affected process.
• Increased risk in shared or multi-application hosting environments, depending on isolation and permissions.

Both vulnerabilities are serious because exploitation may occur before the application's own authentication and security checks are reached.

Which PHP Versions Are Affected?

The PHP security advisory identifies affected versions across multiple PHP branches. The following releases contain the fixes for the currently supported branches.

Earlier releases within these branches are affected and should be updated.

PHP 8.1 and older versions are end-of-life and do not receive regular security fixes from the PHP project. Some operating-system vendors and long-term-support providers may supply backported patches for specific versions. Administrators should confirm the patch status with their vendor or upgrade to a supported PHP branch.

Important: Installing a newer PHP version on a development computer does not automatically update the PHP runtime serving a production website.

Official reference: https://www.php.net/

How to Check Your PHP Version

The first step is to identify which PHP version is actually running your website or application.

Check the command-line version

Run the following command on your server:

php -v

Compare the reported version with the security-fixed releases listed above.

Check PHP-FPM

For Linux servers using PHP-FPM, check the relevant service and runtime configuration. Depending on the operating system, you may use:

systemctl status php8.4-fpm

Replace 8.4 with the installed PHP branch. Service names vary by operating system and installation method.

Also check the PHP version configured for the website in your hosting control panel, web server configuration, or PHP-FPM pool.

Check Docker-based deployments

For containerised applications, inspect the PHP version inside the actual running container:

docker compose exec php php -v

Replace php with the PHP service name defined in your Compose configuration.

If your application uses a custom image, updating your local PHP installation will not update the container. You must rebuild and redeploy the image with a patched PHP release.

Verify the production runtime

After updating, confirm the PHP version used by the actual website or API. Command-line PHP, PHP-FPM, Apache PHP, and containerised PHP may use different installations.

Avoid leaving a publicly accessible diagnostic page containing PHP configuration details on a production server.

How to Fix These PHP Security Vulnerabilities

The PHP development team recommends immediate installation of the relevant security updates. There is no complete workaround that replaces patching.

Step 1: Back up your application

Before upgrading, take an appropriate backup of your application files, database, and deployment configuration. Confirm that you have a recovery plan.

Step 2: Update PHP through your package manager or hosting provider

On managed hosting platforms, use the provider's supported PHP update process and confirm that the selected version includes the security patches.

On self-managed servers, install the patched PHP packages from your operating-system vendor or the appropriate supported repository.

For PHP 8.4, for example, the target upstream release is PHP 8.4.27 or later with the relevant fixes.

Step 3: Update Docker images

If your Dockerfile uses a PHP base image, change it to a patched release appropriate for your application.

For example:

FROM php:8.4.27-fpm-alpine3.21

This is an illustrative example. Confirm that the selected PHP release and Alpine image tag are available and compatible with your deployment before using it.

Then rebuild and redeploy the service:

docker compose build --pull php
docker compose up -d php
docker compose exec php php -v

Replace php with your actual Compose service name.

Check the running image and deployed configuration as well as the version reported inside the container. A successful build alone does not establish that production is using the patched image.

Step 4: Restart affected services

After installing the updates, restart or reload the appropriate PHP-FPM service, application workers, or containers as required by your deployment process.

This helps ensure that old worker processes are no longer serving requests with the previous runtime.

Step 5: Test your applications

After deployment, test the following:

• Website pages and login functionality.
• PHP APIs and authentication endpoints.
• File uploads and document processing.
• Database connectivity and background jobs.
• Application logs and server resource usage.
• Scheduled tasks and queue workers.

Monitor the application after the update to identify errors or compatibility issues.

What If You Cannot Update Immediately?

Patching remains the recommended solution. If an immediate update is not possible, take temporary measures to reduce exposure while arranging a proper fix.

Depending on the deployment, these may include:

• Restricting public access to vulnerable applications.
• Isolating affected services from the internet until they can be patched.
• Applying relevant vendor-provided mitigations.
• Reviewing request-size limits, upload handling, and PHP worker configuration.
• Monitoring server logs and investigating suspicious activity.

Some configuration changes can reduce exposure to specific exploitation paths, but they do not fully eliminate these vulnerabilities. Do not treat a Web Application Firewall, Cloudflare rule, or PHP configuration change as a substitute for a security update.

If you suspect that a server has already been compromised, patching alone may not be sufficient. Investigate the incident, review credentials and access logs, and restore system integrity before returning the application to normal operation.

How These Vulnerabilities Affect Businesses

PHP is used in business websites, e-commerce platforms, customer portals, content management systems, and enterprise applications.

A compromised PHP runtime may put more than a single website at risk. The potential consequences depend on the permissions and isolation available to the affected process.

Businesses should pay particular attention to:

Customer information: Personal data and other records accessible to the application may be at risk.

Business credentials: Database passwords, API keys, email credentials, and other secrets accessible to the PHP process could be exposed.

Service availability: Attackers may disrupt application operations or use a compromised environment for additional malicious activity.

Business continuity: A security incident may lead to investigation costs, downtime, recovery work, and reputational damage.

For organisations running multiple PHP applications, prioritising runtime updates across all production environments is essential.

PHP Security Best Practices for 2026

In addition to addressing these two vulnerabilities, businesses should establish a consistent security-maintenance process.

1. Keep PHP supported and patched. Track PHP security announcements and plan upgrades before a branch reaches end of life.
2. Maintain a runtime inventory. Document PHP versions across production servers, staging environments, containers, and scheduled workers.
3. Automate container updates. Use controlled image rebuilds, vulnerability scanning, and deployment verification.
4. Apply least-privilege permissions. Limit the files, databases, credentials, and system resources available to each application.
5. Secure secrets. Avoid storing sensitive credentials in public directories or committing them to source control.
6. Monitor application activity. Review unusual requests, unexpected PHP errors, new processes, and suspicious changes to application files.
7. Maintain reliable backups. Test restoration procedures instead of assuming that backup files are sufficient.
8. Test updates before deployment where practical. Use staging environments and automated tests while prioritising urgent security patches.

How SRK IT Solutions Can Help

SRK IT Solutions Private Limited provides web application development and IT solutions using technologies including PHP, Symfony, API Platform, Next.js, and AWS.

Maintaining a secure application requires attention to the full technology stack, including the PHP runtime, server configuration, application dependencies, access controls, and deployment procedures.

Businesses can review their PHP environments, identify outdated runtimes, plan supported upgrades, and establish a repeatable maintenance process to reduce the risk of future security incidents.

For assistance with PHP application maintenance, server upgrades, or web application security improvements, contact SRK IT Solutions.